Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The globrex npm package is designed to convert glob expressions into regular expressions. This allows for matching strings against complex patterns, commonly used for file matching in file systems. It supports a wide range of glob patterns, including wildcards, choice groups, and negated patterns.
Convert glob to regex
This feature allows you to convert a simple glob pattern, like '*.js', into its equivalent regular expression. This is useful for matching filenames or strings that end with '.js'.
const globrex = require('globrex');
const { regex } = globrex('*.js');
console.log(regex); // Outputs the regex equivalent of the '*.js' glob pattern
Extended glob patterns
Globrex supports extended glob patterns, such as negated patterns using '!(pattern)'. This example demonstrates converting a negated glob pattern into a regex, which matches any '.js' file that does not start with 'pattern' or 'pattern2'.
const globrex = require('globrex');
const { regex } = globrex('!(pattern|pattern2)*.js');
console.log(regex); // Outputs the regex for negated patterns
Path mode
In path mode, with 'globstar' option enabled, globrex can convert glob patterns that match files in a directory and its subdirectories. This is particularly useful for file system operations where you need to match files across multiple directories.
const globrex = require('globrex');
const { regex } = globrex('path/**/*.js', { globstar: true });
console.log(regex); // Outputs the regex for matching any '.js' file in the 'path' directory and its subdirectories
Minimatch is a minimal matching utility that implements the glob pattern matching found in shells. It is similar to globrex but focuses more on providing a comprehensive solution for matching strings against glob patterns directly, rather than converting them to regex.
Micromatch is a highly optimized glob matching library that offers a wider range of features and better performance compared to globrex. It supports advanced pattern matching and is designed to be a drop-in replacement for minimatch with additional capabilities.
Node-glob is a glob implementation in JavaScript for Node.js. It uses minimatch under the hood but provides filesystem-specific extensions. Unlike globrex, which focuses on converting globs to regex, node-glob is more about performing actual file matching operations in the file system.
npm install globrex --save
ExtGlob
featuresRegExp
segmentsconst globrex = require('globrex');
const result = globrex('p*uck')
// => { regex: /^p.*uck$/, string: '^p.*uck$', segments: [ /^p.*uck$/ ] }
result.regex.test('pluck'); // true
Type: function
Returns: Object
Transform globs intp regular expressions. Returns object with the following properties:
Type: RegExp
JavaScript RegExp
instance.
Note: Read more about how to use RegExp on MDN.
This property only exists if the option filepath
is true.
Note:
filepath
isfalse
by default
Type: Array
Array of RegExp
instances seperated by /
.
This can be usable when working with file paths or urls.
Example array could be:
[ /^foo$/, /^bar$/, /^([^\/]*)$/, '^baz\\.(md|js|txt)$' ]
Type: RegExp
JavaScript RegExp
instance build for testign against paths.
The regex have different path seperators depending on host OS.
Type: String
Glob string to transform.
Type: Boolean
Default: false
Enable all advanced features from extglob
.
Matching so called "extended" globs pattern like single character matching, matching ranges of characters, group matching, etc.
Note: Interprets
[a-d]
as[abcd]
. To match a literal-
, include it as first or last character.
Type: Boolean
Default: false
When globstar is false
globs like '/foo/*'
are transformed to the following
'^\/foo\/.*$'
which will match any string beginning with '/foo/'
.
When the globstar option is true
, the same '/foo/*'
glob is transformed to
'^\/foo\/[^/]*$'
which will match any string beginning with '/foo/'
that does not have a '/'
to the right of it. '/foo/*'
will match: '/foo/bar'
, '/foo/bar.txt'
but not '/foo/bar/baz'
or '/foo/bar/baz.txt'
.
Note: When globstar is
true
,'/foo/**'
is equivelant to'/foo/*'
when globstar isfalse
.
Type: Boolean
Default: false
Be forgiving about mutiple slashes, like ///
and make everything after the first /
optional. This is how bash glob works.
Type: String
Default: ''
RegExp flags (e.g. 'i'
) to pass to the RegExp constructor.
Type: Boolean
Default: false
Parse input strings as it was a file path for special path related features. This feature only makes sense if the input is a POSIX path like /foo/bar/hello.js
or URLs.
When true
the returned object will have an additional path
object.
segment
: Array containing a RegExp
object for each path segment.regex
: OS specific file path RegExp
. Path seperator used is based on the operating system.globstar
: Regex string used to test for globstars.Note: Please only use forward-slashes in file path glob expressions Though windows uses either
/
or\
as its path separator, only/
characters are used by this glob implementation. You must use forward-slashes only in glob expressions. Back-slashes will always be interpreted as escape characters, not path separators.
Learn more about advanced globbing here
MIT © Terkel Gjervig
FAQs
Glob to regular expression with support for extended globs
The npm package globrex receives a total of 3,422,268 weekly downloads. As such, globrex popularity was classified as popular.
We found that globrex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.