
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Retrieves values from JSON objects (and JavaScript objects) by css-selector-like query (includes attribute filters and array flattening).
Retrieves values from JSON objects (and JavaScript objects) by css-selector-like query (includes attribute filters and array flattening).
I am not clever enough to use XPath over objects (via jsonpath, jsonata, JSONPath, ObjectPath or DefiantJs), while I like CSS selectors. JSONSelect looks abandoned, json-query looks overcomplicated; so I created more simple query language (inspired by CSS attribute selectors).
const {get} = require('json-q');
const data = {
a:{
b:[
{name:'xxx',c:{d:1}},
{name:'yyy',c:{d:2}}
]
}
};
get(data, "a b[.c.d=1] name"); //=> ['xxx']
get(object, selector, opt)Returns array of all fields of object from any level of nesting that satisfies selector (with expansions via opt).
About selectors:
About filters:
About pseudos:
Another thing - I consider array as multiple values of field, so
arrays of arrays become flat, i.e. {a:[[1], [2,3]]} becomes {a:[1, 2, 3]}}
you can not address array items by index, i.e.
var data = {
a:{
b:{
c:[1,2]
}
}
};
get(data, ".a.b.c"); //=> [1,2]
get(data, ".a.b.c.0"); //=> []
var data = {
a:{
b:[
{c:1},
{c:2}
]
}
}
get(data, ".a.b.c"); //=> [1,2] also
There are no strings now. So if you have special symbols at field names then you should escape it - I mean dot, colon, square brackets and space symbols (i.e. " .:[]").
var data = {
"a:c":{
x:[1,2]
}
};
get(data, "a:c"); //=> Error "Pseudo 'c' not found."
get(data, "a\\:c"); //=> {x:[1, 2]}
You can add your own filter or pseudo (or re-define existing one). The difference between them is that filter can only filter (obviously) while pseudo can do anything with intermediate result - i.e. delete, add, change (at any depth) objects at result array.
For instance, new filter for [a!=some value]
var d = [{a:{name:1}}, {a:{name:2}}]
var p = "a[name!=1]";
get( d, p, {
operator : {
"!=" : function(complexFieldValue, value){
return true_if_one_is_true(complexFieldValue, value, (a,b)=>{return a!=b;});
},
}
}); // => [{name:2}]
And pseudo for add "abc" string to all fields names at any level (dont ask me what for)
var d = [{a:{b:1}}, {a:{c:2}}]
var p = "a:abc.cabc";
get( d, p, {
pseudo : {
"abc" : function(arrValue){
return arrValue.map(value => {
deep_iterate(value, (_obj) => {
for(var i in _obj) {
if (typeof _obj[i] !== 'object') {
_obj[i+'abc'] = _obj[i];
delete _obj[i];
}
}
});
return value;
})
},
}
}); // => [2]
Please use index.min.js at browser (IE9+ and other modern browsers)
MIT
FAQs
Retrieves values from JSON objects (and JavaScript objects) by css-selector-like query (includes attribute filters and array flattening).
The npm package json-q receives a total of 122 weekly downloads. As such, json-q popularity was classified as not popular.
We found that json-q demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.