
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
easy-object-validator
Advanced tools
深度校验一个对象的属性值是否合法
npm i -S easy-object-validator
# 构建
npm run build
# 单元测试
npm run test
import validator from 'easy-object-validator'
const obj = {
foo: 123,
bar: 'hello',
child: {
foo: true,
bar: [1, 2, 3, 4],
child: {
bar: null
}
}
}
validator(obj, {
foo: validator.test(/^\d+$/),
bar: validator.string().length(5),
child: {
foo: validator.boolean().isRequire(),
bar: validator.array().length(4),
child: validator.object()
}
})
// true
validator 的校验规则基于 Validate 类,下面先介绍 Validate 类
Validate
: classimport Validate from 'easy-object-validator/src/Validate'
const validate = new Validate();
// 校验方法都返回当前 Validate 对象,可以连缀调用
// 这个过程不会执行校验动作
validate.string().length(5).isRequire()
// 执行校验
validate.doValidate('hello') // true
1.1 实例属性:
validate.value
1.2 实例方法:
validate.doValidate(value)
validate.string()
validate.number()
validate.object()
validate.array()
validate.boolean()
validate.isRequire()
validate.length(len)
validate.test(regexp)
validate.is(typeName)
validate.not()
validate.arrayOf(validate)
const validate = new Validate()
// 创建一个新的Validate对象,避免污染
// 可以通过validator上方法快速创建Validate对象
const v = new Validate().string() // 等同于 const v = validator.string()
validate.arrayOf(v).doValidate(['foo']) // true
validate.oneOf(...validator)
let validate = new Validate()
// 创建一个新的Validate对象,避免污染
const v1 = new Validate().string()
const v2 = new Validate().number()
validate.oneOf(v1, v2).doValidate('foo') // true
validate = new Validate()
validate.oneOf(v1, v2).doValidate(123) // true
validate.reset()
let validate = new Validate()
validate.string().doValidate('foo') // true
validate.number().doValidate(123) // false
// reset
validate = new Validate()
validate.string().doValidate('foo') // true
validate.reset().number().doValidate(123) // true
validator
: Function(object, options)object
: [必选] 校验的目标对象options
: [必选] 校验规则validator({
foo: 'hello'
}, {
foo: validator.string()
})
// true
validator.extend
: Function(options)options
: 校验方法对象,对象的属性将作为方法名,对象的属性值是一个方法,用于自定义校验// 调用 .extend 方法后,将在 Validate 类的原型上定义校验方法,
// 同时绑定到 validator 上,调用 validator[validateName] 返回 Validate 对象
// 校验方法接收一个参数,为校验的值
validator.extend({
isName(value) {
return /^[A-Z][A-z]*$/.test(value)
}
})
validator({
foo: 'Alice'
}, {
foo: validator.isName().string()
})
// true
validator.string
: Function()validator({
foo: 'Bob'
}, {
foo: validator.string()
})
// true
validator.number
: Function()validator({
foo: 123
}, {
foo: validator.number()
})
// true
validator.object
: Function()validator({
foo: {}
}, {
foo: validator.object()
})
// true
validator.array
: Function()validator({
foo: []
}, {
foo: validator.array()
})
// true
validator.boolean
: Function()validator({
foo: true
}, {
foo: validator.boolean()
})
// true
validator.isRequire
: Function()validator({
foo: 'hello'
}, {
foo: validator.isRequire()
})
// true
validator.test
: Function(regexp)validator({
foo: '123@bar.com'
}, {
foo: validator.test(/\w+@\w+\.com/)
})
// true
validator.is
: Function(typeName)validator({
foo: []
}, {
foo: validator.is('array')
})
// true
validator.not
: Function()validator({
foo: 123
}, {
foo: validator.not().string()
})
// true
用得不爽就造轮子😶,欢迎提issues或PR
FAQs
The npm package easy-object-validator receives a total of 2 weekly downloads. As such, easy-object-validator popularity was classified as not popular.
We found that easy-object-validator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.