
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
"Javascript Expression Parser" (JEP) is tiny library used to evaluate expression to javascript function
JEP (Javascript Expression Parser) 是一个十分小巧的库,用于将 JavaScript 表达式解析为 JavaScript 函数。
Function,比 eval 快。npm install --save jep
const jep = new JEP()
const fun = jep.make('a + 2 === 3')
const result = fun({a: 1})
console.log(result)
// true
const jep = new JEP({params: ['$', 'SQUARE_METER']})
const scope = {
radius: 3,
square (n) {
return n * n
},
fixed (numObj, num) {
return numObj.toFixed(num)
},
}
const SQUARE_METER = 'm²'
const source = 'fixed((Math.PI + square(radius)), 2) + SQUARE_METER'
const result = jep.make(source)(scope, SQUARE_METER)
console.log(result)
// 12.14m²
const jep = new JEP({
cache: 1000,
scope: '$',
params: ['$', 'other_param'],
})
cache: Number 类型,jep 内部使用 LRU 缓存解析过的表达式,cache 表示最大缓存数,默认 1000
scope: String 类型,在已解析的表达式或函数中,用于表示 scope 的变量名,默认 '$'
const jep = new JEP()
const parsed = jep.parse('a + b')
console.log(parsed)
// $.a+$.b
params: Array 类型,该数组中每一项都为 String 类型,执行函数时需要依次传入对应的参数。
第一个必须为 scope 对应的变量名。其余变量名,在表达式中可以直接被访问。
const jep = new JEP({
params: ['$', 'other'],
})
const scope = {a: 1}
const other = {a: 2}
const result = jep.make('a + other.a')(scope, other)
console.log(result)
// 3
parse: 参数为 String 类型的待编译的表达式,返回编译好的 String 类型表达式
const jep = new JEP()
const source = 'a + b'
const expression = jep.parse(source)
console.log(expression)
// $.a+$.b
build: 参数为 String 类型的已编译表达式,返回编译好的 Function (成功) 或 undefined (失败)
const jep = new JEP()
const source = 'a + b'
const expression = jep.parse(source) // $.a+$.b
const fun = jep.build(expression) // 返回函数,类似 function($){return $.a+$.b}
const result = fun({a: 1, b: 2})
console.log(result)
// 3
buildToString: 和 build 类似,参数为 String 类型的已编译表达式,返回的是函数字符串
const jep = new JEP()
const expression = jep.parse('a + b') // $.a+$.b
const funString = jep.buildToString(expression)
console.log(funString)
// function($){return $.a+$.b}
make: 和 build 类似,参数为 String 类型的待编译表达式,返回编译好的 Function (成功) 或 undefined (失败)
const jep = new JEP()
const source = 'a + b'
const fun = jep.make(source) // 返回函数,类似 function($){return $.a+$.b}
const result = fun({a: 1, b: 2})
console.log(result)
// 3
makeToString: 和 make 类似,参数为 String 类型的待编译表达式,返回的是函数字符串
const jep = new JEP()
const funString = jep.makeToString('a + b')
console.log(funString)
// function($){return $.a+$.b}
FAQs
"Javascript Expression Parser" (JEP) is tiny library used to evaluate expression to javascript function
We found that jep demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.