Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
The aproba package is a lightweight argument validation library for Node.js. It allows developers to assert types and values of arguments in functions, ensuring that the functions are called with the expected arguments. This can help catch bugs early in the development process by providing a simple and concise way to validate function inputs.
Type validation
This feature allows you to validate the types of arguments passed to a function. In the code sample, 'N' stands for number and 'S' for string, ensuring the first argument is a string and the second is a number.
"use strict";
const A = require('aproba');
function exampleFunction(a, b) {
A('NS', arguments);
// Function logic here
}
exampleFunction('hello', 123);
Optional arguments
aproba supports optional arguments in its type validation. In the example, the '?' after 'S' indicates that the second argument is optional. This means the function can be called with just the first argument.
"use strict";
const A = require('aproba');
function exampleFunction(a, b) {
A('NS?', arguments);
// Function logic here
}
exampleFunction('hello');
Joi is a powerful object schema description language and validator for JavaScript objects. Compared to aproba, Joi offers a more extensive set of features for validating complex object structures and custom types, making it suitable for more complex validation scenarios.
validate.js provides a declarative way of validating javascript objects. It is similar to aproba in its purpose of validating function arguments but offers a different API and additional features for validating objects against predefined constraints and custom validation functions.
Yup is a JavaScript schema builder for value parsing and validation. It defines a schema with a more expressive and less verbose syntax compared to aproba. Yup allows for more complex validations, including nested objects and arrays, making it a more versatile choice for data validation.
A ridiculously light-weight function argument validator
var validate = require("aproba")
function myfunc(a, b, c) {
// `a` must be a string, `b` a number, `c` a function
validate('SNF', arguments) // [a,b,c] is also valid
}
myfunc('test', 23, function () {}) // ok
myfunc(123, 23, function () {}) // type error
myfunc('test', 23) // missing arg error
myfunc('test', 23, function () {}, true) // too many args error
Valid types are:
type | description |
---|---|
* | matches any type |
A | Array.isArray OR an arguments object |
S | typeof == string |
N | typeof == number |
F | typeof == function |
O | typeof == object and not type A and not type E |
B | typeof == boolean |
E | instanceof Error OR null (special: see below) |
Z | == null |
Validation failures throw one of three exception types, distinguished by a
code
property of EMISSINGARG
, EINVALIDTYPE
or ETOOMANYARGS
.
If you pass in an invalid type then it will throw with a code of
EUNKNOWNTYPE
.
If an error argument is found and is not null then the remaining
arguments are optional. That is, if you say ESO
then that's like using a
non-magical E
in: E|ESO|ZSO
.
You can provide more than one signature by separating them with pipes |
.
If any signature matches the arguments then they'll be considered valid.
So for example, say you wanted to write a signature for
fs.createWriteStream
. The docs for it describe it thusly:
fs.createWriteStream(path[, options])
This would be a signature of SO|S
. That is, a string and and object, or
just a string.
Now, if you read the full fs
docs, you'll see that actually path can ALSO
be a buffer. And options can be a string, that is:
path <String> | <Buffer>
options <String> | <Object>
To reproduce this you have to fully enumerate all of the possible
combinations and that implies a signature of SO|SS|OO|OS|S|O
. The
awkwardness is a feature: It reminds you of the complexity you're adding to
your API when you do this sort of thing.
This has no dependencies and should work in browsers, though you'll have noisier stack traces.
I wanted a very simple argument validator. It needed to do two things:
Be more concise and easier to use than assertions
Not encourage an infinite bikeshed of DSLs
This is why types are specified by a single character and there's no such thing as an optional argument.
This is not intended to validate user data. This is specifically about asserting the interface of your functions.
If you need greater validation, I encourage you to write them by hand or look elsewhere.
FAQs
A ridiculously light-weight argument validator (now browser friendly)
The npm package aproba receives a total of 10,378,324 weekly downloads. As such, aproba popularity was classified as popular.
We found that aproba demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.