
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
json-logic-engine
Advanced tools
Have you ever needed the ability to write a custom set of logic or set of rules for a particular customer? Or needed to be able to configure a piece of logic on the fly?
JSON Logic might be your solution! Designed with a lisp-like syntax, JSON Logic makes it easy to write safe instructions that can be persisted into a database, and shared between the front-end and back-end.
Check out our Documentation Here.
The engine supports both synchronous & asynchronous operations, and can use function compilation to keep your logic performant at scale.
Examples:
The premise is the logic engine traverses the document you pass in, and each "object" is interpreted as an instruction for the engine to run.
logic.run({
'+': [1,2,3,4,5]
}) // 15
If you wanted to start factoring variables, you can pass a data object into it, and reference them using the "var" instruction:
logic.run({
'+': [11, { var: 'a' }]
}, {
'a': 17
}) // 28
The engine will also allow you to reference variables that are several layers deep:
logic.run({
'+': [{ var: 'a.b.c' }, 5]
}, {
a: { b: { c: 7 } }
}) // 12
Let's explore some slightly more complex logic:
logic.run({
'reduce': [{ var: 'x' }, { '+': [{ var: 'current' }, { var: 'accumulator' }] }, 0]
}, {
'x': [1,2,3,4,5]
}) // 15
In this example, we run the reduce operation on a variable called "x", and we set up instructions to add the "current" value to the "accumulator", which we have set to 0.
Similarly, you can also do map
operations:
logic.run({
'map': [[1,2,3,4,5], { '+': [{ var: '' }, 1] }]
}) // [2,3,4,5,6]
If var
is left as an empty string, it will assume you're referring to the whole variable that is accessible at the current layer it is looking at.
Example of a map accessing variables of the objects in the array:
logic.run({
'map': [{var : 'x'}, { '+': [{ var: 'a' }, 1] }]
},
{
'x': [{ a: 1 }, { a: 2 }, { a: 3 }, { a: 4 }]
}) // [2,3,4,5]
You can easily nest different operations in each other, like so:
logic.run({
max: [200, {
'*': [12, {var: 'a' }]
}]
}, {
a: 16
}) // 200
The engine also supports Handlebars-esque style traversal of data when you use the iterative control structures.
For example:
logic.run({
'map': [{var : 'x'}, { '+': [{ var: 'a' }, { var: '../../adder'}] }]
},
{
'x': [{ a: 1 }, { a: 2 }, { a: 3 }, { a: 4 }],
'adder': 7
}) // [8, 9, 10, 11]
This library was developed to be (for the most part) a drop-in replacement for the popular npm module json-logic-js
.
The intention of the library is to keep the functionality very similar to the original, while adding a few useful utilities.
FAQs
Construct complex rules with JSON & process them.
The npm package json-logic-engine receives a total of 9,349 weekly downloads. As such, json-logic-engine popularity was classified as popular.
We found that json-logic-engine demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.