Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Easy interactive prompts to create and validate data using JSON schema.
We use JSON files to hold important configuration like the metadata for our published pages. But filling out those files is often tedious and prone to error.
Using JSON schema helps us ensure config files contain the correct information. ask-json gives us a way to make filling out and validating those files easy. It hooks into our publishing process and creates an interactive step to validate configuration before it's used.
ask-json lets you turn any JSON schema into an interactive CLI prompt. Just create a schema with some validation rules. ask-json will ask for any required information using friendly, data-type specific prompts using prompts.js.
It's best used to check an existing JSON file, correct invalid and missing information and write that data back to the file.
$ npm install ask-json
or
$ yarn add ask-json
ask-json is driven by JSON schema validation. Check out the official docs to learn more about the spec.
Internally, ask-json uses ajv to validate data.
Ask for data based on a JSON schema file.
$ askjson jsonSchema.json
Validate some data in a file. Answers to invalid or missing data will be rewritten to the file.
$ askjson jsonSchema.json -f output.json
import askJSON from 'ask-json';
const jsonSchema = {
type: 'object',
properties: {
title: {
type: 'string',
},
author: {
type: 'object',
properties: {
name: {
type: 'string',
},
email: {
type: 'string',
format: 'email',
},
},
required: ['name', 'email'],
},
},
required: ['title', 'author'],
};
const testData = {
author: { name: 'Jon McClure' },
};
// Will ask user for title and author.email data!
const data = await askJSON(jsonSchema, testData);
As of the current version, ask-json handles simple schema validation rules and not all keywords are supported.
These are validation keywords currently handled by type:
number
- maximum, minimum, exclusiveMaximum, exclusiveMinimum, multipleOfstring
- maxLength, minLength, pattern, formatarray
- minItems, itemsobject
- requiredArrays in ask-json can only contain items of one type. For example, ask-json does not support this schema:
{
"type": "array",
"items": {
"oneOf": [
{ "type": "number"},
{ "type": "string"}
]
}
}
Because ask-json uses validation errors to trigger questions, any fields you want to prompt for when missing must be marked required. For example, in the following schema, ask-json will never ask for the email
property unless it contains invalid data.
{
"name": {
"type": "string"
},
"email": {
"type": "string",
"format": "email"
},
"required": [
"name"
]
}
You can customize the questions used to ask users for missing or invalid data by adding a prompt
property to your schema with prompts.js question options.
There are some conditions: You won't have access to the name
property on your questions. Also, all functions will not have access to any previous answers -- e.g., (prev, values) => { ... }
.
Lastly, the message
property does not follow the usual signature in prompts.js. Instead, you can supply a static string or a function which receives two params: the object dot-path of the variable being set and a message from ajv if the current value is invalid.
Here's an example of some custom prompts:
const schema = {
type: 'object',
email: {
type: 'string',
format: 'email',
prompt: {
message: (variablePath, invalidMessage = null) => {
if(!invalidMessage) return 'What\'s your email?';
return `What\'s your email? (${invalidMessage})`;
}
}
}
color: {
type: 'color',
prompt: {
type: 'select',
choices: [
{ title: 'Red', value: '#ff0000' },
{ title: 'Green', value: '#00ff00' },
{ title: 'Blue', value: '#0000ff' },
],
}
}
}
$ yarn build && yarn test
FAQs
Easy interactive prompts to create and validate data using JSON schema
We found that ask-json demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.