
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
asl-path-validator
Advanced tools
This library provides a parser to validate Path, Reference Path, and Payload Template expressions for the Amazon States Language
The parser produces an Abstract Syntax Tree (AST) for the expression if it's valid. Additional checks are performed if necessary to limit the operators or presence of functions based on the context.
The expressions resemble JSONPath.
$.store.book
$.store\.book
$.\stor\e.boo\k
$.store.book.title
$.foo.\.bar
$.foo\@bar.baz\[\[.\?pretty
$.&Ж中.\uD800\uDF46
$.ledgers.branch[0].pending.count
$.ledgers.branch[0]
$.ledgers[0][22][315].foo
$['store']['book']
$['store'][0]['book']
expect(validatePath("$.library.movies", AslPathContext.REFERENCE_PATH)).toStrictEqual({
isValid: true,
});
Provides adapters to register as custom format validators for AJV.
The AJV schemas for the Step Functions are not provided here. See asl-validator for schemas. See the provided unit tests for integrating. An example schema is defined to illustrate how to leverage AJV to invoke our custom validation.
beforeAll(() => {
ajv = new Ajv({
schemas: [example, payloadTemplateSchema],
allowUnionTypes: true,
});
registerAll(ajv);
});
it("should accept valid input", () => {
expect.hasAssertions();
const input = loadDefinition("valid.json");
const result = ajv.validate(
"https://asl-path-validator.cloud/example.json#",
input
);
expect(result).toBe(true);
});
The spec references a Java library for the syntax of the expressions.
The documentation for the referenced library has more functionality than is supported by the AWS Step Function runtimes.
Expression Feature | Path | Reference Path | Payload Template |
---|---|---|---|
Simple dot notation or single predicate notation$.library.movies | :white_check_mark: | :white_check_mark: | :white_check_mark: |
Use of operators that select multiple nodes via descent, wildcard, or a filter.. @ , : ? * | :white_check_mark: | :x: | :white_check_mark: |
Intrinsic functionsStates.JsonToString($.foo) See below for the supported functions | :x: | :x: | :white_check_mark: |
When a Path begins with "$$", two dollar signs, this signals that it is intended to identify content within the Context Object. The first dollar sign is stripped, and the remaining text, which begins with a dollar sign, is interpreted as the JSONPath applying to the Context Object.
These functions are available within the context of a Payload Template only.
The relevant fields to examine are Parameters and ResultSelector.
Intrinsic Function | Arguments | Comments |
---|---|---|
States.Format | 1+ | arguments MAY contain one or more Path |
States.StringToJson | 1 | argument MAY be a Path |
States.JsonToString | 1 | argument MUST be a Path |
States.Array | 0+ | arguments MAY contain onr or more Path |
Filters are logical expressions used to filter arrays. A typical filter would be [?(@.age > 18)]
where @
represents
the current item being processed.
Note that the comparison operators only work with numeric values in the AWS Data flow simulator
The table below includes all the fields within a Step Function that are validated.
See asl-validator 3.x branch or higher for schemas modeling ASL.
The schema provided here illustrate how to integrate and includes a recursive definition for the Payload Template context.
Step Function Field | Expression Type |
---|---|
BooleanEqualsPath | Path |
HeartbeatSecondsPath | Reference Path |
InputPath | Path |
ItemsPath | Reference Path |
NumericEqualsPath | Path |
NumericGreaterThanPath | Path |
NumericLessThanEqualsPath | Path |
NumericLessThanPath | Path |
OutputPath | Path |
Parameters | Payload Template |
ResultPath | Reference Path |
ResultSelector | Payload Template |
SecondsPath | Reference Path |
StringEqualsPath | Path |
StringGreaterThanPath | Path |
StringGreaterThanEqualsPath | Path |
StringLessThanPath | Path |
StringLessThanEqualsPath | Path |
TimeoutSecondsPath | Reference Path |
TimestampEqualsPath | Path |
TimestampGreaterThanEqualsPath | Path |
TimestampGreaterThanPath | Path |
TimestampLessThanEqualsPath | Path |
TimestampPath | Reference Path |
FAQs
Validates the path expressions for the Amazon States Language
The npm package asl-path-validator receives a total of 91,773 weekly downloads. As such, asl-path-validator popularity was classified as popular.
We found that asl-path-validator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.