
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
expression-service
Advanced tools
Service to parse and evaluate math expressions.
Compact recursive descent expression parser, and evaluation service for closed-form analytic expressions. Service supports boolean expressions, regular algebraic expressions, numeric and string functions, variables, and closures.
Target: ES2022 [browser+NodeJS][ESM+CJS].
The expression parsing is performed using the following grammar:
<list> = <disjunction>{ ","<disjunction> }
<disjunction> = <conjunction>{ "|"<conjunction> }
<conjunction> = <comparison>{ "&"<comparison> }
<comparison> = { "!" }<aggregate>{ ( ">" | ">=" | "<" | "<=" | "=" | "!=" | "~" | "!~" )<aggregate> }
<aggregate> = <product>{ ( "+" | "-" | "#" | "$" )<product> }
<product> = <factor>{ ( "*" | "/" | "%" )<factor> }
<factor> = { "-" }<coalescence>{ "^"<coalescence> }
<coalescence> = <accessor>{ "?="<accessor> }
<accessor> = <term>{ ( "["<disjunction>"]" | "@"<array-index> | "{"<disjunction>"}" |
"."( <property-name> | <function-name>"("{ <disjunction> }{ ","<disjunction> }")" ) ) }
<term> = <number> | <string> | <constant-name> |
<function-name>"("{ <disjunction> }{ ","<disjunction> }")" |
{ <type> } <variable-name>{ ":"<disjunction> } |
<type>"("<type> <argument>{ ","<type> <argument> }")" "=>"<list> |
"("<disjunction>")" |
"["{ <disjunction> }{ ","<disjunction> }"]" |
"{"{ <property-name>:<disjunction> }{ ","<property-name>:<disjunction> }"}" |
"if" <condition> "then" <disjunction> "else" <disjunction>
<type> = ( "void" | "boolean" | "number" | "string" | "array" | "object" | "function" ){ "?" } | "var"
Whitespace characters are ignored.
Valid variable or function names consist of a letter, or "_" characters followed by any combination of alphanumeric characters, and "_". For example: x, _a1, abc25
Create instance of ExpressionService for math expression. During the parsing any alphanumeric sequence not identified as number value, string value, operator, or a function name is assumed to be variable. Evaluate the expression by providing variable values.
Sample code:
...
const expr = new ExpressionService( 'x * (y + abc / 5) > 10' );
const value1 = expr.evaluate( { x: 10, y: 20, abc: 10 } ); // true
const value2 = expr.evaluate( { x: 1, y: 4, abc: 5 } ); // false
...
const arrExpr = new ExpressionService( '[ 1, 2, 3, a, b, c ].add()' );
const valueSum = arrExpr.evaluate( { a: 10, b: 20, c: 30 } ); // 66
...
const objExpr = new ExpressionService( '{prop1:a,prop2:`abc`}.prop1+10' );
const oValue = objExpr.evaluate( { a: 50 } ); // 60
...
const iteratorExpr = new ExpressionService(
'arr.map(number(number a) -> a*2).filter(boolean(number a) => a>3).add()'
);
const iValue = iteratorExpr.evaluate( { arr: [ 1, 2, 3 ] } ); // 10
...
const complexExpr = new ExpressionService(
'var a:myvar1/10, var b:myvar2-100, a/b + b*a + 600'
);
const value = complexExpr.evaluate( { myvar1: 40, myvar2: 104 } ); // 4761
...
FAQs
Expression Service
We found that expression-service demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.