Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
babel-preset-php
Advanced tools
This project transpiles PHP source code to readable JavaScript source code.
The conversion is implemented as an AST to AST translation (with source maps!). Produced code will have valid JavaScript syntax, but may not work quite the same way due to many conceptual differences between the languages.
PHP input → | → generated JS |
---|---|
define('FOO', max(floatval($c), strlen("foo"))); $bar['x'][][$b] = json_encode(__FILE__); class Foo extends Bar\Baz { var $z = "hello" . "world"; function __construct($some = array(7)) { parent::__construct(func_get_args()); self::${$k} = "{$this->z[10]}"; } } | const FOO = Math.max(+c, "foo".length); bar.x.push({[b]: JSON.stringify(__filename)}); class Foo extends Bar.Baz { constructor(some = [7]) { super(arguments); this.z = "hello" + "world"; this.constructor[k] = `${this.z[10]}`; } } |
You must have Node.js 7 or later. This is a Babel preset. Install it with npm i -S babel-preset-php
. Configure it the same way you'd configure other presets such as es2015
. For example, set .babelrc
to:
{
"presets": ["php"]
}
and then convert files with Babel as usual, e.g:
npm i -g babel-cli
babel file.php -o file.js
Almost all of PHP 7 syntax is supported. Most constructs do vaguely what you'd expect.
strlen
, array_pop
, and is_bool
are translated to JS equivalents. For more complex functions, see Locutus.array()
is ambiguous in JS, because it could either be an associative {}
or numeric []
array. Empty array is translated as Array()
, so you can find and correct it.foreach
is translated as for-of
or for-in
loops. They are different in many subtle ways.Foo\Bar
are changed to Foo.Bar
and it's up to you to make that work.+
is ambiguous and type-sensitive, so you'll have lots of 2+2=22
errors. PHP string concatenation .
is translated as +
.NULL
is semantically closer to undefined
, and is translated as such.+
should cast to numbers.+
/.
and []
/{}
ambiguities.include_path
. You'll need to manually fix require()
.__get
.&$a
is translated as just a
.@
.$_POST[]
, header()
, echo
and other request/response dependent code. In Node.js these are not global.die()
/exit()
are inappropriate in Node.js servers.Error
can't be subclassed correctly.It works! You may need to add var echo = document.write.bind(document); var global = window;
and patch a few other functions.
This project wouldn't happen without ichiriac's PHP parser and Babel generator.
FAQs
Convert PHP7 to JavaScript via Babel preset
The npm package babel-preset-php receives a total of 129 weekly downloads. As such, babel-preset-php popularity was classified as not popular.
We found that babel-preset-php demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.