Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
babel-plugin-flow-runtime
Advanced tools
Transforms flow type annotations into flow-runtime types, optionally adds runtime type validation to annotated code.
A babel plugin which transforms Flow annotations into Type
instances available at runtime, and optionally checks values against those types.
Supports all of flow's syntax, aims for full compatibilty with flow, found a bug? Please report it.
Turns code like this:
type User = {
id: number;
name: string;
};
Into code like this:
import t from 'flow-runtime';
const User = t.type('User', t.object(
t.property('id', t.number()),
t.property('name', t.string())
));
Which you can then use like this:
User.assert({id: 123, name: 'Sally'}); // ok
User.assert({id: false, name: 'Bob'}); // throws
This plugin has a runtime dependency on flow-runtime, so make sure you install that along with this package:
npm install --save-dev babel-plugin-flow-runtime
npm install --save flow-runtime
Next, add the following to your babel configuration or .babelrc
:
{
"plugins": [["flow-runtime", {
"assert": true,
"annotate": true
}]]
}
The plugin supports the following options:
assert
- Boolean, indicates whether types should be asserted at runtime. Defaults to true
if process.env.NODE_ENV === 'development'
, otherwise false
.annotate
- Boolean, indicates whether object or function values that have type annotations should be decorated with those types at runtime. Defaults to true
.libraryName
- String, indicates which runtime to use. Defaults to flow-runtime
If assert
is true
, the following code:
const add = (a: number, b: number): number => a + b;
will be transformed into:
import t from 'flow-runtime';
const add = (a, b) => {
let _aType = t.number();
let _bType = t.number();
const _returnType = t.return(t.number());
t.param('a', _aType).assert(a);
t.param('b', _bType).assert(b);
return _returnType.assert(a + b);
};
Which is very safe, and can be very useful during development, but has a non-trivial performance overhead. It's usually a good idea to disable this feature in production.
If annotate
is true
, the following:
const add = (a: number, b: number): number => a + b;
will be transformed into:
import t from 'flow-runtime';
const add = t.annotate(
(a, b) => a + b,
t.function(
t.param('a', t.number()),
t.param('b', t.number()),
t.return(t.number())
)
);
Now invoking add(x, y)
does not incur any overhead, as the parameters are not checked, but the type information is preserved and available for inspection:
console.log(String(t.typeOf(add))); // (a: number, b: number) => number
If both assert
and annotate
are false
then value annotations are ignored, but type aliases are still transformed:
type User = {
id: number;
name: string;
};
turns into:
import t from 'flow-runtime';
const User = t.type('User', t.object(
t.property('id', t.number()),
t.property('name', t.string())
));
When the plugin encounters a React component with a props
type annotation, the annotation is converted to react prop types:
import React from 'react';
type Props = {
name: string;
};
export class App extends React.Component<void, Props, void> {
render () {
return <h1>{this.props.name}</h1>;
}
}
Becomes
import t from 'flow-runtime';
import React from 'react';
const Props = t.type('Props', t.object(
t.property('name', t.string())
));
export class App extends React.Component {
static propTypes = t.propTypes(Props);
render () {
return <h1>{this.props.name}</h1>;
}
}
FAQs
Transforms flow type annotations into flow-runtime types, optionally adds runtime type validation to annotated code.
The npm package babel-plugin-flow-runtime receives a total of 1,406 weekly downloads. As such, babel-plugin-flow-runtime popularity was classified as popular.
We found that babel-plugin-flow-runtime demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.