Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
ast-verify
Collection of helper functions to verify a AST tree structure.
Example: verify if a tree represents a JSON.stringify()
call
const {
isCallExpression,
isMemberExpression,
isIdentifier
} = require("ast-verify");
// Check if the tree represents a `JSON.stringify()` call.
const isJsonStringify = isCallExpression({
callee: isMemberExpression({
object: isIdentifier("JSON"),
property: isIdentifier("stringify")
})
});
Most functions are named isSomething
where Something
is the type of the node (i.e. isIdentifier
checks if node.type === "Identifier"
). They accept a single argument: an object where keys represent the property of a node and the value is a matcher for that property.
The accepted matchers are: a matcher function, primitive values, arrays or functions.
Calling a function with no arguments means it will only assert its type and none of the properties. For types with no properties (i.e. ThisExpression
), arguments are ignored.
For nodes with only a single property (i.e. Identifier
with property name
), you can pass directly the matcher for that property, so you don't have to pass an object with a single property. For example, isIdentifier("foo")
is equivalent to isIdentifier({ name: "foo" })
.
Passing extra properties to a matcher will make it always return false:
// check() will always return false since there's no `name` property in CallExpression
const check = isCallExpression({ name: "foo" });
either
For cases where a node can be one of many values:
const { either, isIdentifier, isMemberExpression } = require("ast-verify");
// Check if the three is a `JSON.stringify()` or `stringify()` call
const isStringify = isCallExpression({
callee: either(
isMemberExpression({
object: isIdentifier("JSON"),
property: isIdentifier("stringify")
}),
isIdentifier("stringify")
)
});
This library consists of helper functions automatically generated on top of the excellent @babel/types
definitions.
FAQs
Helper functions to verify an AST structure
The npm package ast-verify receives a total of 0 weekly downloads. As such, ast-verify popularity was classified as not popular.
We found that ast-verify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.