![PyPI Slashes Malware Response Time: 90% of Issues Resolved in Under 24 Hours](https://cdn.sanity.io/images/cgdhsj6q/production/eee3e3fc69826f43dfc3366b71472d981003a5cb-1024x1024.webp?w=400&fit=max&auto=format)
Security News
PyPI Slashes Malware Response Time: 90% of Issues Resolved in Under 24 Hours
PyPI has drastically improved its malware response times, resolving 90% of issues in under 24 hours and removing 900 projects since March 2024.
codem-isoboxer
Advanced tools
Readme
codem-isoboxer
is a lightweight JavaScript MP4 (MPEG-4, ISOBMFF) parser. It is meant to be small, fast and efficient. A typical use-case would be inclusion in a new player framework (for emerging standards such as MPEG-DASH which rely on ISOBMFF for most situations, or HLS using fragmented MP4) or to extract metadata from MPEG-4 files:
emsg
boxes for in-band events;mdat
boxes for extracting subtitles;Currently a limited set of ISOBMFF boxes is supported:
Support for more boxes can easily be added by adding additional box parsers in src/parsers
. Some utility functions are included to help with reading the various ISOBMFF data types from the raw file. Also, see the Box Support page on the Wiki for a full list.
A modern web browser with support for:
Include one of the files in the dist
folder (regular or minified) in your web page/application:
<script type="text/javascript" src="iso_boxer.min.js"></script>
Then, you can parse a file by calling the parseBuffer
function:
var parsedFile = ISOBoxer.parseBuffer(arrayBuffer);
console.log(parsedFile.boxes);
The arrayBuffer
can be obtained for example by issuing an XMLHttpRequest
with responsetype
set to arrayBuffer
, or by using
the FileReader
API to read a local file.
codem-isoboxer
makes no assumptions on the validity of the given file and/or segment. It also does minimal handling of the data
types and provides mostly a raw interface. Some frequently used attributes are parsed to easier-to-use types, such as the major
brand and list of compatible brands in the ftyp
box.
For traversing the box structure you can use the _parent
property. It returns exactly what you expect: the parent of the
current box. The opposite is the boxes
property (only available on container boxes such as moov
), which gives you its children.
Every box also has a _root
property which returns the top-level (file) container.
Another way to use the software is to only retrieve the boxes you are interested in. This way you don't have to traverse the box structure yourself:
var parsedFile = ISOBoxer.parseBuffer(arrayBuffer); // Parse the file
var ftyp = parsedFile.fetch('ftyp'); // Fetch the first box with the specified type (`ftyp`)
var mdats = parsedFile.fetchAll('mdat'); // Fetch all the boxes with the specified type (`mdat`)
Traversal of the box structure is always depth first. Note that while you jump directly to a box using the fetch commands, the entire parsed structure is still available, so the _parent
, _root
and boxes
properties are still available.
An additional utility method is included to convert DataViews into strings. This uses the TextDecoder
interface is available,
otherwise it falls back to a naïve implementation (bytes to character codes). If the TextDecoder
interface is available you can
supply an additional encoding
parameter (defaults to utf-8
) to the function.
var parsedFile = ISOBoxer.parseBuffer(arrayBuffer); // Parse the file
var mdat = parsedFile.fetch('mdat'); // Get the first 'mdat' box
var text = ISOBoxer.Utils.dataViewToString(mdat.data); // Convert the data into a string (e.g. captions)
Basic support for incomplete buffers is also available. Boxes and containers that cannot be fully parsed (due to an empty buffer)
will be marked with an _incomplete
property. You can simply add new data to the ArrayBuffer
when it becomes available and
re-parse the buffer.
Does it work in NodeJS? Well, it's really meant to be run in a web browser, but since Node supports most features it shouldn't be a problem. You can install it using NPM:
npm install codem-isoboxer
Then use it in your code (NodeJS v0.10.36 tested, 0.12.x should work as well):
var ISOBoxer = require('codem-isoboxer'),
fs = require('fs');
var arrayBuffer = new Uint8Array(fs.readFileSync('my_test_file.mp4')).buffer;
var parsedFile = ISOBoxer.parseBuffer(arrayBuffer);
Et voila. It does not support any of the fancy stream stuff from Node. Also, the Node console has some issues with printing objects that contain buffers/dataviews/circular references. It might not look pretty in the console, but it works.
Check out the source from Github. Make changes to the files in /src
(not in /dist
). We use grunt
to build the distribution files. If you add a box parser be sure to include a comment that points toward the relevant section in the specs. And if at all possible add a (small!) file to test/fixtures
to provide an example.
The test directory is not included in the published package on npmjs.org because of the included MPEG-4 files.
grunt
You can use grunt-contrib-watch
to watch for changes to the source and automatically build it:
grunt watch
Included is a small set of tests which check the code against a known set of ISOBMFF files. The tests use NodeJS with jasmine-node
.
Make sure you have the grunt watcher running, as it tests against the resulting build of the JavaScript files. Usage:
# npm install jasmine-node -g
# jasmine-node test/spec
When adding new parsers please consider adding an ISOBMFF test file and a relevant test spec.
Please note, for size concerns, tests are only included in the Github repository and not in the released packages on NPM.
By default, codem-isoboxer
build file contains all the code that manages the parsing AND the writing functionalities.
If you are only interested in the parsing functionality, you can generate a build without writing functionality. The syntax for building is:
grunt --no-writing
codem-isoboxer
now has the option for modular builds. This means you can specify which boxes you are interested in during build time and you will get a generated file containing only the necessary boxes. This can help you further decrease the size of the library if you know you will only need access to some boxes. The syntax for building is:
grunt --boxes=moov,mdat
This will generate a build that only contains the code to parse these boxes and can yield significantly smaller builds. The list needs to be comma-separated. Be sure not to include any white-space in it. Note that some parsers share identical code (e.g. ftyp
/styp
, free
/skip
and all the regular container boxes). Including one of those will automatically include the other ones as well, but at no additional build size. See src/parsers
for a list of available parsers and see which parsers share code.
codem-isoboxer
does not take into account the box hierarchy/dependency when building, you must explicitly specify which boxes you need (e.g. if you want to parse mvhd
you must also include moov
). Boxes that are not included don't have their properties set, but you can still access their type and size properties and the raw data (._raw
).
Open test/index.html
in your browser. Use the file picker to select a local MPEG-4 file to parse it. Results will be in the window.parsedFile
variable. Inspect it from your browser's console. Some test files are included in test/fixtures
(not included in the package published on npmjs.org).
codem-isoboxer
is released under the MIT license, see LICENSE.txt
.
FAQs
A lightweight JavaScript MP4 (MPEG-4, ISOBMFF) file/box parser.
We found that codem-isoboxer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI has drastically improved its malware response times, resolving 90% of issues in under 24 hours and removing 900 projects since March 2024.
Security News
Research
The Socket Research team breaks down an obfuscated script designed to facilitate unauthorized file uploads to multiple external services.
Security News
Node.js has automated its security release process, doubling the number of releases, and is re-evaluating unsupported experimental features with the Next 10 group to enhance security.