
Security News
Node.js Moves Toward Stable TypeScript Support with Amaro 1.0
Amaro 1.0 lays the groundwork for stable TypeScript support in Node.js, bringing official .ts loading closer to reality.
expression-eval
Advanced tools
The expression-eval npm package is a simple expression evaluator that can parse and evaluate mathematical expressions. It is useful for evaluating expressions dynamically at runtime, making it a handy tool for applications that require dynamic calculations or formula evaluations.
Basic Arithmetic Evaluation
This feature allows you to evaluate basic arithmetic expressions. The code sample demonstrates how to parse and evaluate a simple arithmetic expression.
const { Parser } = require('expression-eval');
const parser = new Parser();
const expr = parser.parse('2 + 3 * (4 - 1)');
const result = expr.evaluate();
console.log(result); // Output: 11
Variable Support
This feature allows you to include variables in your expressions. The code sample shows how to parse an expression with variables and evaluate it by providing the variable values.
const { Parser } = require('expression-eval');
const parser = new Parser();
const expr = parser.parse('a * b + c');
const variables = { a: 2, b: 3, c: 4 };
const result = expr.evaluate(variables);
console.log(result); // Output: 10
Function Support
This feature allows you to use functions within your expressions. The code sample demonstrates how to parse and evaluate an expression that includes the square root function.
const { Parser } = require('expression-eval');
const parser = new Parser();
const expr = parser.parse('sqrt(a^2 + b^2)');
const variables = { a: 3, b: 4 };
const result = expr.evaluate(variables);
console.log(result); // Output: 5
Custom Functions
This feature allows you to define and use custom functions in your expressions. The code sample shows how to parse and evaluate an expression with a custom function.
const { Parser } = require('expression-eval');
const parser = new Parser();
const expr = parser.parse('customFunc(a, b)');
const variables = { a: 2, b: 3, customFunc: (a, b) => a + b };
const result = expr.evaluate(variables);
console.log(result); // Output: 5
Math.js is an extensive math library for JavaScript and Node.js. It features a flexible expression parser, which can evaluate expressions, perform symbolic computation, and more. Compared to expression-eval, math.js offers a broader range of mathematical functions and capabilities, including support for matrices, units, and complex numbers.
JSEP (JavaScript Expression Parser) is a JavaScript library for parsing JavaScript expressions. It generates an abstract syntax tree (AST) from an expression string, which can then be evaluated or manipulated. While jsep focuses on parsing expressions, it does not include an evaluation engine, making it more suitable for use cases where you need to parse and then manually evaluate or transform expressions.
Expr-eval is another JavaScript expression parser and evaluator. It is similar to expression-eval in terms of functionality, allowing you to parse and evaluate mathematical expressions with support for variables and functions. Expr-eval is known for its simplicity and ease of use, making it a good alternative to expression-eval for basic expression evaluation needs.
JavaScript expression parsing and evaluation.
⚠️ UNMAINTAINED: The
expression-eval
npm package is no longer maintained. The package was originally published as part of a now-completed personal project, and I do not have incentives to continue maintenance. Please feel free to use the code, but be aware that support and updates will not be available.
⚠️ SECURITY NOTICE: As mentioned under Security below, this library does not attempt to provide a secure sandbox for evaluation. Evaluation involving user inputs (expressions or values) may lead to unsafe behavior. If your project requires a secure sandbox, consider alternatives such as vm2.
Powered by jsep.
Install:
npm install --save expression-eval
Import:
// ES6
import { parse, eval } from 'expression-eval';
// CommonJS
const { parse, eval } = require('expression-eval');
// UMD / standalone script
const { parse, eval } = window.expressionEval;
import { parse } from 'expression-eval';
const ast = parse('1 + foo');
The result of the parse is an AST (abstract syntax tree), like:
{
"type": "BinaryExpression",
"operator": "+",
"left": {
"type": "Literal",
"value": 1,
"raw": "1"
},
"right": {
"type": "Identifier",
"name": "foo"
}
}
import { parse, eval } from 'expression-eval';
const ast = parse('a + b / c'); // abstract syntax tree (AST)
const value = eval(ast, {a: 2, b: 2, c: 5}); // 2.4
Alternatively, use evalAsync
for asynchronous evaluation.
import { compile } from 'expression-eval';
const fn = compile('foo.bar + 10');
fn({foo: {bar: 'baz'}}); // 'baz10'
Alternatively, use compileAsync
for asynchronous compilation.
Although this package does avoid the use of eval()
, it cannot guarantee that user-provided expressions, or user-provided inputs to evaluation, will not modify the state or behavior of your application. This library does not attempt to provide a secure sandbox for evaluation. Evaluation of arbitrary user inputs (expressions or values) may lead to unsafe behavior. If your project requires a secure sandbox, consider alternatives such as vm2.
MIT License.
FAQs
JavaScript expression parsing and evaluation.
The npm package expression-eval receives a total of 199,190 weekly downloads. As such, expression-eval popularity was classified as popular.
We found that expression-eval demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Amaro 1.0 lays the groundwork for stable TypeScript support in Node.js, bringing official .ts loading closer to reality.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.