๐Ÿšจ Shai-Hulud Strikes Again:834 Packages Compromised.Technical Analysis โ†’
Socket
Book a DemoInstallSign in
Socket

@ts-graphviz/ast

Package Overview
Dependencies
Maintainers
1
Versions
83
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@ts-graphviz/ast

Graphviz AST(Abstract Syntax Tree) Utilities

Source
npmnpm
Version
3.0.5-next-9296372cefd7dcf81ff8d3d827bb124ac56849ec
Version published
Weekly downloads
785K
-7.93%
Maintainers
1
Weekly downloads
ย 
Created
Source

Main CodeQL License: MIT All Contributors

OpenSSF Best Practices OpenSSF Scorecard Tidelift

npm version node version deno version npm

@ts-graphviz/ast

This package contains the module for processing the DOT language at the Abstract Syntax Tree (AST) level for the ts-graphviz library.

๐Ÿ”—

GitHub npm Reference Ask DeepWiki

Sponsor OpenCollective

format: Biome test: Vitest build: Vite

It is part of the ts-graphviz library, which is split into modular packages to improve maintainability, flexibility, and ease of use.

Overview

This package is a foundational component of the ts-graphviz library that enables low-level manipulation of DOT language structures. It provides a parser that converts DOT language strings into AST nodes and a stringifier that converts AST nodes back to DOT language.

Main Functions

The AST package provides several key functions:

  • parse(input: string, options?): Parses a DOT language string into an AST structure
  • stringify(ast: ASTNode): Converts an AST structure to a DOT language string
  • fromModel(model): Converts a Graph Model to an AST structure
  • toModel(ast): Converts an AST structure to a Graph Model

Usage Examples

Parsing DOT Language

import { parse } from "@ts-graphviz/ast";

const dotString = "digraph G { A -> B; }";
const ast = parse(dotString);
console.log(ast);
// Output: A DotASTNode representing the DOT structure

Parser Options

The parse function accepts an optional second argument for configuration:

import { parse } from "@ts-graphviz/ast";

// Parse with custom security limits
const ast = parse(dotString, {
  startRule: 'Dot',              // Specify the starting rule (default: 'Dot')
  maxHtmlNestingDepth: 200,      // Maximum HTML nesting depth (default: 100)
  maxEdgeChainDepth: 2000,       // Maximum edge chain depth (default: 1000)
  maxInputSize: 20971520,        // Maximum input size in bytes (default: 10MB)
  maxASTNodes: 200000            // Maximum AST nodes (default: 100,000)
});

Available Options:

OptionDefaultDescription
startRule'Dot'Starting grammar rule for parsing
maxHtmlNestingDepth100Maximum depth of nested HTML-like structures
maxEdgeChainDepth1000Maximum depth of chained edges (e.g., a -> b -> c -> ...)
maxInputSize10485760 (10MB)Maximum input size in bytes
maxASTNodes100000Maximum number of AST nodes to create

Security Note:

These limits protect against denial-of-service attacks:

  • maxHtmlNestingDepth: Prevents stack overflow from deeply nested HTML-like structures

    • Normal use cases: typically <10 levels
    • HTML-like labels are GraphViz DOT syntax, not browser HTML
  • maxEdgeChainDepth: Prevents stack overflow from deeply chained edges

    • Example dangerous input: a -> b -> c -> ... -> z (1000+ nodes)
  • maxInputSize: Prevents memory exhaustion from extremely large files

    • Default 10MB is sufficient for most legitimate graphs
    • Can be increased for known large graphs or disabled with 0 (not recommended for untrusted input)
  • maxASTNodes: Prevents memory exhaustion from inputs with excessive elements

    • Each DOT element creates multiple AST nodes
    • Example: A single node statement (node1;) creates ~2-3 AST nodes
    • Can be disabled with 0 (not recommended for untrusted input)

Important: When processing untrusted DOT files (e.g., user uploads), keep these limits enabled with conservative values appropriate for your environment. For additional validation of untrusted content, see the validation guide in @ts-graphviz/adapter documentation.

Generating DOT Language

import { parse, stringify } from "@ts-graphviz/ast";

const dotString = "digraph G { A -> B; }";
const ast = parse(dotString);
// Modify the AST if needed
const outputDotString = stringify(ast);
console.log(outputDotString);
// Output: "digraph G { A -> B; }"

Error Handling

The package provides a specialized error class for handling syntax errors during parsing.

When a parsing error occurs, the parser throws a DotSyntaxError with detailed information about the issue, which helps in debugging DOT language syntax problems.

Contributors ๐Ÿ‘ฅ

Thanks goes to these wonderful people (emoji key):

Yuki Yamazaki
Yuki Yamazaki

๐Ÿ’ป โš ๏ธ ๐Ÿ“– ๐Ÿค”
LaySent
LaySent

๐Ÿ› โš ๏ธ
elasticdotventures
elasticdotventures

๐Ÿ“–
Christian Murphy
Christian Murphy

๐Ÿ’ป ๐Ÿค” ๐Ÿ“–
Artem
Artem

๐Ÿ›
fredericohpandolfo
fredericohpandolfo

๐Ÿ›
diegoquinteiro
diegoquinteiro

๐Ÿ›
robross0606
robross0606

๐Ÿค”
Blake Regalia
Blake Regalia

๐Ÿ›
bigbug
bigbug

๐Ÿ’ฌ
mrwk
mrwk

๐Ÿ’ฌ
svdvonde
svdvonde

๐Ÿ’ฌ
Adam
Adam

๐Ÿ’ฌ
Trevor Scheer
Trevor Scheer

๏ธ๏ธ๏ธ๏ธโ™ฟ๏ธ
Prem Pillai
Prem Pillai

๐Ÿ›
nagasawaryoya
nagasawaryoya

๐Ÿ’ป โš ๏ธ
YukiSasaki
YukiSasaki

๐Ÿ’ป โš ๏ธ
Madd0g
Madd0g

๐Ÿ›
j4k0xb
j4k0xb

๐Ÿ›
HKrogstie
HKrogstie

๐Ÿ›
Nils K
Nils K

๐Ÿ›
hao2013
hao2013

๐Ÿšง ๐Ÿ‘€
Walter Rafelsberger
Walter Rafelsberger

๐Ÿ’ฌ
grsjst
grsjst

๐Ÿ›
Steve
Steve

๐Ÿ›

This project follows the all-contributors specification. Contributions of any kind welcome!

Changelog ๐Ÿ“œ

See CHANGELOG.md for more details.

License โš–๏ธ

This software is released under the MIT License, see LICENSE.

FAQs

Package last updated on 10 Nov 2025

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts