Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
http-parser-js
Advanced tools
The http-parser-js npm package is a pure JavaScript implementation of the HTTP parsing component of Node.js. It can be used as a drop-in replacement for the built-in http parser in Node.js, providing a way to parse HTTP messages (requests and responses) without relying on the native parser. This can be useful in environments where the native parser is not available or when a different parsing behavior is desired.
Parsing HTTP Requests
This code sample demonstrates how to use http-parser-js to parse an HTTP request. The parser object is created with the type HTTPParser.REQUEST, and callback functions are assigned to handle headers, body, and the completion of the message.
const httpParser = require('http-parser-js').HTTPParser;
const parser = new httpParser(httpParser.REQUEST);
parser[httpParser.kOnHeadersComplete] = function(headers, url) {
// Use headers and url
};
parser[httpParser.kOnBody] = function(body) {
// Use body
};
parser[httpParser.kOnMessageComplete] = function() {
// Message is complete
};
// Simulate receiving data
const data = Buffer.from('GET / HTTP/1.1\r\nHost: example.com\r\n\r\n');
parser.execute(data);
Parsing HTTP Responses
This code sample shows how to parse an HTTP response using http-parser-js. The parser object is created with the type HTTPParser.RESPONSE, and callback functions are set up to process headers, body, and the end of the message.
const httpParser = require('http-parser-js').HTTPParser;
const parser = new httpParser(httpParser.RESPONSE);
parser[httpParser.kOnHeadersComplete] = function(headers, statusCode) {
// Use headers and statusCode
};
parser[httpParser.kOnBody] = function(body) {
// Use body
};
parser[httpParser.kOnMessageComplete] = function() {
// Message is complete
};
// Simulate receiving data
const data = Buffer.from('HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nHello World');
parser.execute(data);
http-message-parser is a package that parses raw HTTP message strings into an object representation. It differs from http-parser-js in that it works with complete message strings and does not stream the data. This can be simpler for certain applications but less efficient for others.
This library parses HTTP protocol for requests and responses.
It was created to replace http_parser.c
since calling C++ functions from JS is really slow in V8.
However, it is now primarily useful in having a more flexible/tolerant HTTP parser when dealing with legacy services that do not meet the strict HTTP parsing rules Node's parser follows.
This is packaged as a standalone npm module. To use in node, monkeypatch HTTPParser.
// Monkey patch before you require http for the first time.
process.binding('http_parser').HTTPParser = require('http-parser-js').HTTPParser;
var http = require('http');
// ...
Simply run npm test
.
The tests are copied from node and mscedex/io.js, with some modifcations.
This should now be usable in any node application, it now supports (nearly) everything http_parser.c
does while still being tolerant with corrupted headers, and other kinds of malformed data.
http-parser-js
should work via monkey-patching on Node v6-v11, and v13-14.
Node v12.x renamed the internal http parser, and did not expose it for monkey-patching, so to be able to monkey-patch on Node v12, you must run node --http-parser=legacy file.js
to opt in to the old, monkey-patchable http_parser binding.
While this module is intended to be used as a replacement for the internal Node.js parser, it can be used as a standalone parser. The standalone-example.js
demonstrates how to use the somewhat awkward API (coming from compatibility with the Node.js internals) to parse HTTP from raw Buffers.
MIT. See LICENSE.md
FAQs
A pure JS HTTP parser for node.
The npm package http-parser-js receives a total of 11,663,036 weekly downloads. As such, http-parser-js popularity was classified as popular.
We found that http-parser-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.