Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
BSON is short for "Binary JSON," and is the binary-encoded serialization of JSON-like documents. You can learn more about it in the specification.
Think you've found a bug? Want to see a new feature in bson
? Please open a case in our issue management tool, JIRA:
Bug reports in JIRA for all driver projects (i.e. NODE, PYTHON, CSHARP, JAVA) and the Core Server (i.e. SERVER) project are public.
To build a new version perform the following operations:
npm install
npm run build
When using a bundler or Node.js you can import bson using the package name:
import { BSON, EJSON, ObjectId } from 'bson';
// or:
// const { BSON, EJSON, ObjectId } = require('bson');
const bytes = BSON.serialize({ _id: new ObjectId() });
console.log(bytes);
const doc = BSON.deserialize(bytes);
console.log(EJSON.stringify(doc));
// {"_id":{"$oid":"..."}}
If you are working directly in the browser without a bundler please use the .mjs
bundle like so:
<script type="module">
import { BSON, EJSON, ObjectId } from './lib/bson.mjs';
const bytes = BSON.serialize({ _id: new ObjectId() });
console.log(bytes);
const doc = BSON.deserialize(bytes);
console.log(EJSON.stringify(doc));
// {"_id":{"$oid":"..."}}
</script>
npm install bson
object
Sets the size of the internal serialization buffer.
Buffer
Serialize a Javascript object.
Number
Serialize a Javascript object using a predefined Buffer and index into the buffer, useful when pre-allocating the space for serialization.
Object
Deserialize data as BSON.
Number
Calculate the bson size for a passed in Javascript object.
Number
Deserialize stream data as BSON documents.
Param | Type | Default | Description |
---|---|---|---|
text | string | ||
[options] | object | Optional settings | |
[options.relaxed] | boolean | true | Attempt to return native JS types where possible, rather than BSON types (if true) |
Parse an Extended JSON string, constructing the JavaScript value or object described by that string.
Example
const { EJSON } = require('bson');
const text = '{ "int32": { "$numberInt": "10" } }';
// prints { int32: { [String: '10'] _bsontype: 'Int32', value: '10' } }
console.log(EJSON.parse(text, { relaxed: false }));
// prints { int32: 10 }
console.log(EJSON.parse(text));
Param | Type | Default | Description |
---|---|---|---|
value | object | The value to convert to extended JSON | |
[replacer] | function | array | A function that alters the behavior of the stringification process, or an array of String and Number objects that serve as a whitelist for selecting/filtering the properties of the value object to be included in the JSON string. If this value is null or not provided, all properties of the object are included in the resulting JSON string | |
[space] | string | number | A String or Number object that's used to insert white space into the output JSON string for readability purposes. | |
[options] | object | Optional settings | |
[options.relaxed] | boolean | true | Enabled Extended JSON's relaxed mode |
[options.legacy] | boolean | true | Output in Extended JSON v1 |
Converts a BSON document to an Extended JSON string, optionally replacing values if a replacer function is specified or optionally including only the specified properties if a replacer array is specified.
Example
const { EJSON } = require('bson');
const Int32 = require('mongodb').Int32;
const doc = { int32: new Int32(10) };
// prints '{"int32":{"$numberInt":"10"}}'
console.log(EJSON.stringify(doc, { relaxed: false }));
// prints '{"int32":10}'
console.log(EJSON.stringify(doc));
Param | Type | Description |
---|---|---|
bson | object | The object to serialize |
[options] | object | Optional settings passed to the stringify function |
Serializes an object to an Extended JSON string, and reparse it as a JavaScript object.
Param | Type | Description |
---|---|---|
ejson | object | The Extended JSON object to deserialize |
[options] | object | Optional settings passed to the parse method |
Deserializes an Extended JSON object into a plain JavaScript object with native/BSON types
Param | Type | Description |
---|---|---|
size | number | The desired size for the internal serialization buffer |
Sets the size of the internal serialization buffer.
Param | Type | Default | Description |
---|---|---|---|
object | Object | the Javascript object to serialize. | |
[options.checkKeys] | Boolean | the serializer will check if keys are valid. | |
[options.serializeFunctions] | Boolean | false | serialize the javascript functions (default:false). |
[options.ignoreUndefined] | Boolean | true | ignore undefined fields (default:true). |
Serialize a Javascript object.
Returns: Buffer
- returns the Buffer object containing the serialized object.
Param | Type | Default | Description |
---|---|---|---|
object | Object | the Javascript object to serialize. | |
buffer | Buffer | the Buffer you pre-allocated to store the serialized BSON object. | |
[options.checkKeys] | Boolean | the serializer will check if keys are valid. | |
[options.serializeFunctions] | Boolean | false | serialize the javascript functions (default:false). |
[options.ignoreUndefined] | Boolean | true | ignore undefined fields (default:true). |
[options.index] | Number | the index in the buffer where we wish to start serializing into. |
Serialize a Javascript object using a predefined Buffer and index into the buffer, useful when pre-allocating the space for serialization.
Returns: Number
- returns the index pointing to the last written byte in the buffer.
Param | Type | Default | Description |
---|---|---|---|
buffer | Buffer | the buffer containing the serialized set of BSON documents. | |
[options.evalFunctions] | Object | false | evaluate functions in the BSON document scoped to the object deserialized. |
[options.cacheFunctions] | Object | false | cache evaluated functions for reuse. |
[options.useBigInt64] | Object | false | when deserializing a Long will return a BigInt. |
[options.promoteLongs] | Object | true | when deserializing a Long will fit it into a Number if it's smaller than 53 bits |
[options.promoteBuffers] | Object | false | when deserializing a Binary will return it as a node.js Buffer instance. |
[options.promoteValues] | Object | false | when deserializing will promote BSON values to their Node.js closest equivalent types. |
[options.fieldsAsRaw] | Object |
| allow to specify if there what fields we wish to return as unserialized raw buffer. |
[options.bsonRegExp] | Object | false | return BSON regular expressions as BSONRegExp instances. |
[options.allowObjectSmallerThanBufferSize] | boolean | false | allows the buffer to be larger than the parsed BSON object. |
Deserialize data as BSON.
Returns: Object
- returns the deserialized Javascript Object.
Param | Type | Default | Description |
---|---|---|---|
object | Object | the Javascript object to calculate the BSON byte size for. | |
[options.serializeFunctions] | Boolean | false | serialize the javascript functions (default:false). |
[options.ignoreUndefined] | Boolean | true | ignore undefined fields (default:true). |
Calculate the bson size for a passed in Javascript object.
Returns: Number
- returns the number of bytes the BSON object will take up.
Param | Type | Default | Description |
---|---|---|---|
data | Buffer | the buffer containing the serialized set of BSON documents. | |
startIndex | Number | the start index in the data Buffer where the deserialization is to start. | |
numberOfDocuments | Number | number of documents to deserialize. | |
documents | Array | an array where to store the deserialized documents. | |
docStartIndex | Number | the index in the documents array from where to start inserting documents. | |
[options] | Object | additional options used for the deserialization. | |
[options.evalFunctions] | Object | false | evaluate functions in the BSON document scoped to the object deserialized. |
[options.cacheFunctions] | Object | false | cache evaluated functions for reuse. |
[options.promoteLongs] | Object | true | when deserializing a Long will fit it into a Number if it's smaller than 53 bits |
[options.promoteBuffers] | Object | false | when deserializing a Binary will return it as a node.js Buffer instance. |
[options.promoteValues] | Object | false | when deserializing will promote BSON values to their Node.js closest equivalent types. |
[options.fieldsAsRaw] | Object |
| allow to specify if there what fields we wish to return as unserialized raw buffer. |
[options.bsonRegExp] | Object | false | return BSON regular expressions as BSONRegExp instances. |
Deserialize stream data as BSON documents.
Returns: Number
- returns the next index in the buffer after deserialization x numbers of documents.
It is our recommendation to use BSONError.isBSONError()
checks on errors and to avoid relying on parsing error.message
and error.name
strings in your code. We guarantee BSONError.isBSONError()
checks will pass according to semver guidelines, but errors may be sub-classed or their messages may change at any time, even patch releases, as we see fit to increase the helpfulness of the errors.
Any new errors we add to the driver will directly extend an existing error class and no existing error will be moved to a different parent class outside of a major release.
This means BSONError.isBSONError()
will always be able to accurately capture the errors that our BSON library throws.
Hypothetical example: A collection in our Db has an issue with UTF-8 data:
let documentCount = 0;
const cursor = collection.find({}, { utf8Validation: true });
try {
for await (const doc of cursor) documentCount += 1;
} catch (error) {
if (BSONError.isBSONError(error)) {
console.log(`Found the troublemaker UTF-8!: ${documentCount} ${error.message}`);
return documentCount;
}
throw error;
}
BSON requires that TextEncoder
, TextDecoder
, atob
, btoa
, and crypto.getRandomValues
are available globally. These are present in most Javascript runtimes but require polyfilling in React Native. Polyfills for the missing functionality can be installed with the following command:
npm install --save react-native-get-random-values text-encoding-polyfill base-64
The following snippet should be placed at the top of the entrypoint (by default this is the root index.js
file) for React Native projects using the BSON library. These lines must be placed for any code that imports BSON
.
// Required Polyfills For ReactNative
import {encode, decode} from 'base-64';
if (global.btoa == null) {
global.btoa = encode;
}
if (global.atob == null) {
global.atob = decode;
}
import 'text-encoding-polyfill';
import 'react-native-get-random-values';
Finally, import the BSON
library like so:
import { BSON, EJSON } from 'bson';
This will cause React Native to import the node_modules/bson/lib/bson.cjs
bundle (see the "react-native"
setting we have in the "exports"
section of our package.json.)
The "exports"
definition in our package.json
will result in BSON's CommonJS bundle being imported in a React Native project instead of the ES module bundle. Importing the CommonJS bundle is necessary because BSON's ES module bundle of BSON uses top-level await, which is not supported syntax in React Native's runtime hermes.
undefined
get converted to null
?The undefined
BSON type has been deprecated for many years, so this library has dropped support for it. Use the ignoreUndefined
option (for example, from the driver ) to instead remove undefined
keys.
This library looks for toBSON()
functions on every path, and calls the toBSON()
function to get the value to serialize.
const BSON = require('bson');
class CustomSerialize {
toBSON() {
return 42;
}
}
const obj = { answer: new CustomSerialize() };
// "{ answer: 42 }"
console.log(BSON.deserialize(BSON.serialize(obj)));
FAQs
A bson parser for node.js and the browser
The npm package db3-bson receives a total of 1 weekly downloads. As such, db3-bson popularity was classified as not popular.
We found that db3-bson demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.