Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
grunt-banana-checker
Advanced tools
Checker for the 'Banana' JSON-file format for interface messages, as used by MediaWiki and jQuery.i18n.
Checker for the 'Banana' JSON-file format for interface messages, as used by MediaWiki and jQuery.i18n.
By default, Banana checker asserts the following:
@metadata
object.For all available options, see the Options section.
You can use Banana checker standalone or as a Grunt plugin.
To use this plugin, add it as a development dependency to your project:
npm install grunt-banana-checker --save-dev
Ensure your project has a Gruntfile.js file (example file). Then, in Gruntfile.js, add the line:
grunt.loadNpmTasks( 'grunt-banana-checker' );
In Gruntfile.js, add a configuration key for banana
and set it to an empty object.
We will use this object to declare which directory contains the interface messages. For example, to enable grunt-banana-checker for a single directory only, configure it like so:
grunt.initConfig( { banana: { all: 'i18n/' } } );
You can also configure multiple directories, like so:
grunt.initConfig( { banana: { core: 'languages/i18n/', installer: 'includes/installer/i18n/' } } );
You can also use globbing patterns and/or arrays of directories, like so:
grunt.initConfig( { banana: { all: 'modules/ve-{mw,wmf}/i18n/' } } );
For a full list of supported ways of defining the target directory of a Grunt plugin, see Configuring tasks on gruntjs.com.
See the Options sections for create a config file.
Config can also be set in Grunt by defining your target directory as an object instead of a string, with src
and options
properties, like so:
grunt.initConfig( { banana: { all: { src: 'i18n/', options: { sourceFile: 'messages.json', documentationFile: 'documentation.json' } } } } );
For all available options, see the Options section.
The Banana checker also offers a command-line interface.
npm install grunt-banana-checker --save-dev
To use Banana checker as part of your test run, refer to the banana-checker
program from the scripts.test
property in your package.json
file.
{ "scripts": { "test": "banana-checker i18n/" } }
Options can be set in the config file, or overridden as --key=value
pairs. For example:
npx banana-checker --requireKeyPrefix="x-" i18n/
0
, 1
, true
, or false
.--key=one,two
.Create a .bananaconfig.[json|js]
file (or bananaconfig.[json|js]
):
{ "sourceFile": "messages.json", "documentationFile": "documentation.json" }
Available options are:
Type: boolean
Default value: false
If enabled, try to automatically fix issues in en/qqq.json detected by some checks.
Note that autofixing will not affect the check result - the checker will fail even if all errors were automatically fixed.
Type: boolean
Default value: false
Same as autofix
but for translated messages.
Type: string
Default value: "en.json"
The JSON file providing the primary messages.
Type: string
Default value: "qqq.json"
The JSON file providing the documentation messages.
Rule options can be set to "off"
, "warn"
or "error"
. When additional options are available an array
tuple should be created, e.g. [ "error", { "initial: true } ]
.
Default value: "error"
Whether to fail if message files don't have a @metadata
meta-data key.
Default value: "error"
Additional option: skip
(type string[]
) Keys to skip
Whether to fail if any message is in the primary file but not documented.
Default value: "error"
Whether to fail if any message is in the primary file but documented as a blank string.
Default value: "error"
Additional option: initial
(type boolean
, default false
)
Whether to fail if any message key is not lower case. If the "initial"
option is set,
fail only if the first character is not lower case.
Default value: "off"
Additional option: prefix
(type string
or string[]
)
Whether to fail if any message key is not prefixed by the given prefix, or if multiple, one of the given prefixes.
Default value: "error"
Whether to fail if any documented message isn't in the primary file.
Default value: "warn"
Whether to warn if any message is translated as a blank string.
Default value: "off"
Whether to fail if any message is translated as identical to the original string.
Default value: "off"
Whether to fail if any translated message isn't in the primary file.
Default value: "off"
Whether to fail if any translated message fails to use a parameter used in the primary message.
Default value: "off"
Additional option: langs
(type string[]
) Languages required
Additional option: ignoreMissing
(type boolean
, default true
) Ignore missing translations whose original string is blank
Example value: [ "error", { "langs": [ "fr", "es" ], "ignoreMissing": false } ]
Languages on which to fail if any message in the primary file is missing.
Default value: "off"
Additional option: keys
(type string[]
) Message keys to require
Example value: [ "error", { "keys": [ "first-message-key", "second-message-key" ] } ]
Messages on which to fail if missing in any provided language.
Default value: "off"
Whether to ignore leading whitespace in original messages.
Default value: "off"
Whether to ignore leading whitespace in translated messages.
Default value: "error"
Whether to ignore trailing whitespace in original messages.
Default value: "warn"
Whether to ignore trailing whitespace in original messages.
FAQs
Checker for the 'Banana' JSON-file format for interface messages, as used by MediaWiki and jQuery.i18n.
The npm package grunt-banana-checker receives a total of 12,093 weekly downloads. As such, grunt-banana-checker popularity was classified as popular.
We found that grunt-banana-checker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 26 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.