Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@taktikangea/aperiam-rerum
Advanced tools
[![NPM Package](https://img.shields.io/npm/v/url-pattern.svg?style=flat)](https://www.npmjs.org/package/url-pattern) [![Build Status](https://travis-ci.org/taktikangea/aperiam-rerum.svg?branch=master)](https://travis-ci.org/taktikangea/aperiam-rerum/branc
easier than regex string matching patterns for urls and other strings.
turn strings into data or data into strings.
This is a great little library -- thanks!
michael
var pattern = new UrlPattern('/api/users(/:id)');
match pattern against string and extract values:
pattern.match('/api/users/10'); // {id: '10'}
pattern.match('/api/users'); // {}
pattern.match('/api/products/5'); // null
generate string from pattern and values:
pattern.stringify() // '/api/users'
pattern.stringify({id: 20}) // '/api/users/20'
require('url-pattern')
UrlPattern
when neither CommonJS nor AMD are available.npm install url-pattern
bower install url-pattern
check out passage if you are looking for simple composable routing that builds on top of url-pattern
npm install url-pattern
bower install url-pattern
> var UrlPattern = require('url-pattern');
> var pattern = new UrlPattern('/v:major(.:minor)/*');
> pattern.match('/v1.2/');
{major: '1', minor: '2', _: ''}
> pattern.match('/v2/users');
{major: '2', _: 'users'}
> pattern.match('/v/');
null
> var pattern = new UrlPattern('(http(s)\\://)(:subdomain.):domain.:tld(\\::port)(/*)')
> pattern.match('google.de');
{domain: 'google', tld: 'de'}
> pattern.match('https://www.google.com');
{subdomain: 'www', domain: 'google', tld: 'com'}
> pattern.match('http://mail.google.com/mail');
{subdomain: 'mail', domain: 'google', tld: 'com', _: 'mail'}
> pattern.match('http://mail.google.com:80/mail');
{subdomain: 'mail', domain: 'google', tld: 'com', port: '80', _: 'mail'}
> pattern.match('google');
null
> var pattern = new UrlPattern('/api/users/:id');
a pattern
is immutable after construction.
none of its methods changes its state.
that makes it easier to reason about.
match returns the extracted segments:
> pattern.match('/api/users/10');
{id: '10'}
or null
if there was no match:
> pattern.match('/api/products/5');
null
patterns are compiled into regexes which makes .match()
superfast.
:id
(in the example above) is a named segment:
a named segment starts with :
followed by the name.
the name must be at least one character in the regex character set a-zA-Z0-9
.
when matching, a named segment consumes all characters in the regex character set
a-zA-Z0-9-_~ %
.
a named segment match stops at /
, .
, ... but not at _
, -
,
, %
...
you can change these character sets. click here to see how.
if a named segment name occurs more than once in the pattern string, then the multiple results are stored in an array on the returned object:
> var pattern = new UrlPattern('/api/users/:ids/posts/:ids');
> pattern.match('/api/users/10/posts/5');
{ids: ['10', '5']}
to make part of a pattern optional just wrap it in (
and )
:
> var pattern = new UrlPattern(
'(http(s)\\://)(:subdomain.):domain.:tld(/*)'
);
note that \\
escapes the :
in http(s)\\://
.
you can use \\
to escape (
, )
, :
and *
which have special meaning within
url-pattern.
optional named segments are stored in the corresponding property only if they are present in the source string:
> pattern.match('google.de');
{domain: 'google', tld: 'de'}
> pattern.match('https://www.google.com');
{subdomain: 'www', domain: 'google', tld: 'com'}
*
in patterns are wildcards and match anything.
wildcard matches are collected in the _
property:
> pattern.match('http://mail.google.com/mail');
{subdomain: 'mail', domain: 'google', tld: 'com', _: 'mail'}
if there is only one wildcard then _
contains the matching string.
otherwise _
contains an array of matching strings.
look at the tests for additional examples of .match
> var pattern = new UrlPattern(/^\/api\/(.*)$/);
if the pattern was created from a regex an array of the captured groups is returned on a match:
> pattern.match('/api/users');
['users']
> pattern.match('/apiii/test');
null
when making a pattern from a regex you can pass an array of keys as the second argument. returns objects on match with each key mapped to a captured value:
> var pattern = new UrlPattern(
/^\/api\/([^\/]+)(?:\/(\d+))?$/,
['resource', 'id']
);
> pattern.match('/api/users');
{resource: 'users'}
> pattern.match('/api/users/5');
{resource: 'users', id: '5'}
> pattern.match('/api/users/foo');
null
> var pattern = new UrlPattern('/api/users/:id');
> pattern.stringify({id: 10})
'/api/users/10'
optional segments are only included in the output if they contain named segments and/or wildcards and values for those are provided:
> var pattern = new UrlPattern('/api/users(/:id)');
> pattern.stringify()
'/api/users'
> pattern.stringify({id: 10})
'/api/users/10'
wildcards (key = _
), deeply nested optional groups and multiple value arrays should stringify as expected.
an error is thrown if a value that is not in an optional group is not provided.
an error is thrown if an optional segment contains multiple params and not all of them are provided. one provided value for an optional segment makes all values in that optional segment required.
look at the tests for additional examples of .stringify
finally we can completely change pattern-parsing and regex-compilation to suit our needs:
> var options = {};
let's change the char used for escaping (default \\
):
> options.escapeChar = '!';
let's change the char used to start a named segment (default :
):
> options.segmentNameStartChar = '$';
let's change the set of chars allowed in named segment names (default a-zA-Z0-9
)
to also include _
and -
:
> options.segmentNameCharset = 'a-zA-Z0-9_-';
let's change the set of chars allowed in named segment values
(default a-zA-Z0-9-_~ %
) to not allow non-alphanumeric chars:
> options.segmentValueCharset = 'a-zA-Z0-9';
let's change the chars used to surround an optional segment (default (
and )
):
> options.optionalSegmentStartChar = '[';
> options.optionalSegmentEndChar = ']';
let's change the char used to denote a wildcard (default *
):
> options.wildcardChar = '?';
pass options as the second argument to the constructor:
> var pattern = new UrlPattern(
'[http[s]!://][$sub_domain.]$domain.$toplevel-domain[/?]',
options
);
then match:
> pattern.match('http://mail.google.com/mail');
{
sub_domain: 'mail',
domain: 'google',
'toplevel-domain': 'com',
_: 'mail'
}
the query part of an URL has very different semantics than the rest. url-pattern is not well suited for parsing the query part.
there are good existing libraries for parsing the query part of an URL. https://github.com/hapijs/qs is an example. in the interest of keeping things simple and focused i see no reason to add special support for parsing the query part to url-pattern.
i recommend splitting the URL at ?
, using url-pattern
to parse the first part (scheme, host, port, path)
and using https://github.com/hapijs/qs to parse the last part (query).
you can't exactly match IPs with url-pattern so you have to fall back to regexes and pass in a regex object.
FAQs
security holding package
The npm package @taktikangea/aperiam-rerum receives a total of 0 weekly downloads. As such, @taktikangea/aperiam-rerum popularity was classified as not popular.
We found that @taktikangea/aperiam-rerum demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.