Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
jinx-rust
is a Rust parser written in Typescript; it enables the development of Rust Tooling in Typescript.
Example project using jinx-rust
: Prettier Rust formatter
npm install jinx-rust
import { rs } from "jinx-rust";
const file = rs.parseFile("let leet: u32 = 1337;");
console.log(JSON.stringify(file));
{
"type": "SourceFile",
"program": {
"type": "Program",
"ast": [
{
"type": "LetVariableDeclaration",
"pattern": { "type": "Identifier", "name": "leet" },
"typeAnnotation": { "type": "Identifier", "name": "u32" },
"expression": { "type": "Literal", "kind": 11, "value": "1337" }
}
],
"danglingAttributes": [],
"comments": []
}
}
jinx-rust
is unstrict by default and tolerates bad syntax
Tokens:
===
and !==
)Nodes:
unsafe pub fn ...
)import { rs } from "jinx-rust";
const arg_0 = rs.parseFile("fn foo(arg_0) {}").program.ast[0].parameters[0];
assert(arg_0.typeAnnotation.type === "MissingNode");
In the future, jinx-rust
should eventually get a strict
option.
Attributes and Macro invocation arguments are returned as tokens in rs.parseFile
.
rs
exposes other methods to re-read tokens in arbitrary contexts, or to re-read nodes as tokens.
import { rs, MacroInvocation } from "jinx-rust";
const node = rs.parseFile("foo!(123);").program.ast[0].expression as MacroInvocation;
const args = rs.toCallExpressionArguments(node.tokens).ast; // ExpressionNode[]
const block = rs.toBlockBody(node.tokens).ast; // StatementNode[]
const tokens = rs.toTokens(node).ast; // TokenNode[]
jinx-rust
supports 23 nightly features. The full list can be found in src/parser/nodes.ts
under enum Feature
. (link)
jinx-rust/utils
jinx-rust/utils
is automatically included on install. It is a library of (mostly) auto-generated helpers from the parser's type declarations. E.g. tree traversing helpers, is_{Type}(node)
functions for every type declared exported by the parser.
import { each_node, is_StatementNode } from "jinx-rust/utils";
declare const target: Node;
each_node(target, (child, parent) => {
if (is_StatementNode(child)) {
// gets called for every statement in target
}
});
node.loc.ownStart
jinx-rust/utils
helpers to access locations, e.g. start(node)
instead of node.loc[0]
Exported .d.ts
nodes each document their syntax, hit Go to Definition
or hover over their class to see it.
import { TraitDeclaration } from "jinx-rust";
TraitDeclaration;
// ^? import TraitDeclaration
// trait id<...generics>?: ...typeBounds? where ...whereBounds? { ...body }
filepath
is not required but useful in debugging: rs.parseFile(code, { filepath })
Using node.loc.url()
is an easy, quick way to get a clickable link to nodes causing problems.
To facilitate debugging in NodeJS, class Loc
implements nodejs.util.inspect.custom
Hence in console.log(node)
, loc is logged as node.loc.url()
e.g. TraiDeclaration { ..., loc: "path/to/file.rs:51:18", ... }
jinx-rust
? And why in Typescript?Tooling and compiler should only share the spec in common. Take the tripartite system in Javascript:
Through that lens, Rust is in a rather bleek shape:
Building Rust Tooling on top of rustc is a mistake akin to building Typescript's editor integration on top of v8's Turbofan.
Both have drastically different needs, and attempting to serve both at the same time is grossly counterproductive.
Core needs a minimalistic, clear and no bs parser & AST that follows the syntax allowed in the spec by the dot and to the dot. Arbitrarily injecting lints in the core parser or bloating its data structure with CST is frankly out of scope and corrupts the entire language foundation.
Tooling needs a parser that is much more tolerant and flexible, it should be able to overlook or bend the spec syntax rules to best infer user's intent.
Tooling requires a language with a structure that is much more flexible, dynamic and hackable to accomodate for the wide range and open-endedness of the solutions it seeks to provide. Rust is simply not the right pick for the job, Rust is not the right pick for everything damnit.
FAQs
Rust parser
We found that jinx-rust demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.