Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Get the text position [start, end] of a property in a JSON document.
Given the following JSON:
{
"foo": {
"bar": "baz"
^^^^^
}
}
The position of /foo/bar
(or ["foo", "bar"]
if provided as an array), is:
{
start: { line: 3, column: 16, offset: 30 },
end: { line: 3, column: 21, offset: 35 }
}
where offset
is the character offset in the JSON string.
If the property "bar" is wanted, instead of the value, set markIdentifier
to true
, see Simple usage.
npm i jsonpos
or yarn add jsonpos
dataPath
option has been renamed with changed semantics.
dataPath
is now dotPath
. It's not recommended to use as it's not safe for certain characters.
.
. Only the path .
represents the root object.dataPath
is now simply path
.
pointerPath
is allowed, following JSON Pointer encoding.The package exports the following functions:
jsonpos
the main function, getting the location of a value in a JSON documentjsonpos( json, options: LocationOptions ): Location
where LocationOptions
is:
interface LocationOptions
markIdentifier?: boolean;
// Only one of the following
dotPath: string;
path: Array< string | number >;
pointerPath: string;
}
and Location
is:
interface Location
{
start: Position | undefined;
end: Position | undefined;
}
where Position
is:
interface Position
{
line: number;
column: number;
offset: number;
}
import { jsonpos } from 'jsonpos'
const loc = jsonpos(
'{ "foo": { "bar": "baz" } }',
{ dotPath: '.foo.bar' }
);
Note that dot-separated paths are strongly advised against.
import { jsonpos } from 'jsonpos'
const loc = jsonpos(
'{ "foo": { "bar": "baz" } }',
{ pointerPath: '/foo/bar' }
);
import { jsonpos } from 'jsonpos'
const loc = jsonpos(
'{ "foo": { "bar": "baz" } }',
{ path: [ 'foo', 'bar' ] }
);
The jsonpos
function is a shorthand for getLocation( getAstByString( json ), options )
Extract the AST (using json-to-ast) with getAstByString
or getAstByObject
. The result is an object of type ParsedJson
:
interface ParsedJson
{
json: any;
jsonString: string;
jsonAST: ValueNode; // ValueNode is a json-to-ast type
}
import { getAstByString } from 'jsonpos'
const ast = getAstByString( '{ "foo": "bar" }' );
const { json, jsonString, jsonAST } = ast;
getAstByObject
will stringify the JSON using JSON.stringify(obj, null, 4)
and use that to parse the AST.
import { getAstByObject } from 'jsonpos'
const ast = getAstByObject( { foo: "bar" } );
const { json, jsonString, jsonAST } = ast;
getAstByObject
takes an optional second argument indent
which can be set to something else than 4
if necessary, e.g. 2
:
const ast = getAstByObject( { foo: "bar" }, 2 );
The getLocation
takes an ast object as returned by getAstByString
or getAstByObject
and returns a Location
object.
getLocation( ast: ParsedJson, options: LocationOptions ): Location
import { getAstByString, getLocation } from 'jsonpos'
const ast = getAstByString( '{ "foo": "bar" }' );
const loc = getLocation( ast, { pointerPath: '/foo' } );
This package understand array paths ["foo", "bar"]
, dot-path ".foo.bar"
and JSON Pointer paths /foo/bar
. Support for dot-path is to understand older paths from Ajv. Array paths are often the most practical programatically.
The parsePath
function is what jsonpos
uses to parse the path. It takes on object containing either path
(an array), dotPath
or pointerPath
(strings), and it returns the path as an array.
parsePath( { path: [ "foo", "bar" ] } ); // -> [ "foo", "bar" ]
parsePath( { dotPath: ".foo.bar" } ); // -> [ "foo", "bar" ]
parsePath( { pointerPath: "/foo/bar" } ); // -> [ "foo", "bar" ]
JSON Pointer paths support the slash character (/
) in a path segment, and encodes it with ~1
and ~0
. encodeJsonPointerSegment
and parseJsonPointerSegment
does this:
encodeJsonPointerSegment( "f/o/o" ); // -> "f~1o~1o"
parseJsonPointerSegment( "f~1o~1o" ); // -> "f/o/o"
For complete paths (of segments), use encodeJsonPointerPath
and parseJsonPointerPath
:
encodeJsonPointerPath( [ "f/o/o", "bar" ] ); // -> "/f~1o~1o/bar"
parseJsonPointerPath( "/f~1o~1o/bar" ); // -> [ "f/o/o", "bar" ]
FAQs
Get the textual position of a property in a JSON text
The npm package jsonpos receives a total of 36,710 weekly downloads. As such, jsonpos popularity was classified as popular.
We found that jsonpos demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.