Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The json-minus node module provides a tool for validating and preparing JavaScript objects for database insertion. It targets a subset of JSON documents called JSON Minus.
npm install json-minus
Create a JSON Minus validator by passing a property specification to the JSONMinus
constructor:
var Person = JSONMinus({
'name' : {type: 'string', match: /[a-zA-Z]/},
'eyeColor' : {type: 'string', match: /^(blue|brown|green|gray|hazel)$/},
'weight' : {type: 'number', gt: 0, lt: 500},
'likesSeafood' : {type: 'boolean'}
})
The resulting validator is a function that accepts an object and makes a validated copy of that object. Limited type conversion is performed as the input object is copied:
Person({name: 'Will', eyeColor: 'hazel', weight: '185'})
Produces:
{name: 'Will', eyeColor: 'hazel', weight: 185, likesSeafood: false}
A top-level property of a JSON Minus document may be an array of homogeneous objects. Such arrays and the properties of their contained sub-objects may be specified like this:
var Order = JSONMinus({
'total' : {type: 'string', match: /^\d+\.\d\d$/},
'items.product' : {type: 'string'},
'items.price' : {type: 'string', match: /^\d+\.\d\d$/},
'items.quantity' : {type: 'integer', gte: 1}
})
In this example, an Order
has the property items
which contains an array of sub-objects. Each of those sub-objects have the properties product
, price
, and quantity
.
Sub-objects may not contain further nested structures.
JSON Minus object validators make deep copies of input objects as they perform validation. As the copy is made, some limited type conversion may take place.
NaN
will be converted to decimal strings'true'
or 'false'
0
Infinity
, -Infinity
, and NaN
will result in validation errorsValues will be converted to numbers using the rules specified above and then rounded to integers using Math.round()
.
'true'
and '1'
will be converted to true
'false'
, '0'
, and the empty string will be converted to false
1
will be converted to true
0
will be onverted to false
false
String values may be constrained by a RegExp
provided in the match
property of the property specification. The match
constraint is applied after type conversion.
Numbers and integers may be constrainted with a combination of the properties gt
, gte
, lt
, and lte
of the property specification. These constratins are applied after type conversion.
There are some cases where you may prefer to completely omit a key from the validated copy if the value is an empty string. You can accomplish this with the omitEmpty
option like this:
var CouchDoc = JSONMinus({
_id: {type: 'string', omitEmpty: true},
_rev: {type: 'string', omitEmpty: true},
value: {type: 'string'}
});
Given the validator above,
CouchDoc({_id: 'abc', _rev: '', value: 'foo'})
Produces:
{_id: 'abc', value: 'foo'}
The omitEmpty
option is applied at the very end after the property is coerced to a string and validated via the match
regular expression.
Will Conant, http://willconant.com/
The json-minus module is released under the MIT License.
FAQs
validate and prepare JSON Minus documents
The npm package json-minus receives a total of 0 weekly downloads. As such, json-minus popularity was classified as not popular.
We found that json-minus demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.