Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The globrex npm package is designed to convert glob expressions into regular expressions. This allows for matching strings against complex patterns, commonly used for file matching in file systems. It supports a wide range of glob patterns, including wildcards, choice groups, and negated patterns.
Convert glob to regex
This feature allows you to convert a simple glob pattern, like '*.js', into its equivalent regular expression. This is useful for matching filenames or strings that end with '.js'.
const globrex = require('globrex');
const { regex } = globrex('*.js');
console.log(regex); // Outputs the regex equivalent of the '*.js' glob pattern
Extended glob patterns
Globrex supports extended glob patterns, such as negated patterns using '!(pattern)'. This example demonstrates converting a negated glob pattern into a regex, which matches any '.js' file that does not start with 'pattern' or 'pattern2'.
const globrex = require('globrex');
const { regex } = globrex('!(pattern|pattern2)*.js');
console.log(regex); // Outputs the regex for negated patterns
Path mode
In path mode, with 'globstar' option enabled, globrex can convert glob patterns that match files in a directory and its subdirectories. This is particularly useful for file system operations where you need to match files across multiple directories.
const globrex = require('globrex');
const { regex } = globrex('path/**/*.js', { globstar: true });
console.log(regex); // Outputs the regex for matching any '.js' file in the 'path' directory and its subdirectories
Minimatch is a minimal matching utility that implements the glob pattern matching found in shells. It is similar to globrex but focuses more on providing a comprehensive solution for matching strings against glob patterns directly, rather than converting them to regex.
Micromatch is a highly optimized glob matching library that offers a wider range of features and better performance compared to globrex. It supports advanced pattern matching and is designed to be a drop-in replacement for minimatch with additional capabilities.
Node-glob is a glob implementation in JavaScript for Node.js. It uses minimatch under the hood but provides filesystem-specific extensions. Unlike globrex, which focuses on converting globs to regex, node-glob is more about performing actual file matching operations in the file system.
npm install globrex --save
ExtGlob
featuresRegExp
segmentsconst globrex = require('globrex');
const result = globrex('p*uck')
// => { regex: /^p.*uck$/, string: '^p.*uck$', segments: [ /^p.*uck$/ ] }
result.regex.test('pluck'); // true
Type: function
Returns: Object
Transform globs intp regular expressions. Returns object with the following properties:
Type: RegExp
JavaScript RegExp
instance.
Note: Read more about how to use RegExp on MDN.
This property only exists if the option filepath
is true.
Note:
filepath
isfalse
by default
Type: Array
Array of RegExp
instances seperated by /
.
This can be usable when working with file paths or urls.
Example array could be:
[ /^foo$/, /^bar$/, /^([^\/]*)$/, '^baz\\.(md|js|txt)$' ]
Type: RegExp
JavaScript RegExp
instance build for testign against paths.
The regex have different path seperators depending on host OS.
Type: String
Glob string to transform.
Type: Boolean
Default: false
Enable all advanced features from extglob
.
Matching so called "extended" globs pattern like single character matching, matching ranges of characters, group matching, etc.
Note: Interprets
[a-d]
as[abcd]
. To match a literal-
, include it as first or last character.
Type: Boolean
Default: false
When globstar is false
globs like '/foo/*'
are transformed to the following
'^\/foo\/.*$'
which will match any string beginning with '/foo/'
.
When the globstar option is true
, the same '/foo/*'
glob is transformed to
'^\/foo\/[^/]*$'
which will match any string beginning with '/foo/'
that does not have a '/'
to the right of it. '/foo/*'
will match: '/foo/bar'
, '/foo/bar.txt'
but not '/foo/bar/baz'
or '/foo/bar/baz.txt'
.
Note: When globstar is
true
,'/foo/**'
is equivelant to'/foo/*'
when globstar isfalse
.
Type: Boolean
Default: false
Be forgiving about mutiple slashes, like ///
and make everything after the first /
optional. This is how bash glob works.
Type: String
Default: ''
RegExp flags (e.g. 'i'
) to pass to the RegExp constructor.
Type: Boolean
Default: false
Parse input strings as it was a file path for special path related features. This feature only makes sense if the input is a POSIX path like /foo/bar/hello.js
or URLs.
When true
the returned object will have an additional path
object.
segment
: Array containing a RegExp
object for each path segment.regex
: OS specific file path RegExp
. Path seperator used is based on the operating system.globstar
: Regex string used to test for globstars.Note: Please only use forward-slashes in file path glob expressions Though windows uses either
/
or\
as its path separator, only/
characters are used by this glob implementation. You must use forward-slashes only in glob expressions. Back-slashes will always be interpreted as escape characters, not path separators.
Learn more about advanced globbing here
MIT © Terkel Gjervig
FAQs
Glob to regular expression with support for extended globs
We found that globrex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.