Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Live demo: https://wmertens.github.io/jsurl2/ Live editor: https://cv122s.csb.app/
JSURL2 aims to be a drop-in replacement for JSON encoding with better size and time characteristics.
JSURL2 has been designed to be
<script>
tags inside single-quoted Javascript strings (unlike JSON)rich
mode encodes/decodes Date
objects, undefined
, NaN
and Infinity
JSON.parse
with JSURL.parse
and JSON.stringify
with JSURL.stringify
undefined
)Given its speed and size, it is well-suited to pass JS values to scripts in HTML, like initial data after Server-Side-Rendering. To do so, embed the result inside a single-quoted string (not double-quoted) and parse that in your script.
Some room has been left in the encoding space for special values. If you enable rich
on the stringifier, it will encode JS Date objects so that they decode as JS Date objects, and later it might support custom encode/decode of your own object types.
JSON:
{"name": "John Doé", "age": 42, "user": true, "children": ["Mary", "Bill"]}
JSON + URI encoding:
%7B%22name%22%3A%22John%20Do%C3%22%2C%22age%22%3A42%2C%22user%22%3Atrue%2C%22children%22%3A%5B%22Mary%22%2C%22Bill%22%5D%7D
JSURL2:
(name~John_Doé~age~42~user~~children~!Mary~Bill)~
JSURL2 + URI encoding:
(name~John_Do%C3%A9~age~42~user~~children~!Mary~Bill)~
The easiest way to install jsurl2
is with NPM:
npm install jsurl2
var JSURL = require("jsurl2");
// Options:
// * `rich`: encode Date, `undefined`, `Infinity`
// * `short`: remove optional trailing delimiters
str = JSURL.stringify(obj[, options]);
// Options:
// * `deURI`: remove URI encoding and whitespace
obj = JSURL.parse(str[, options]);
// return `default` instead of throwing on error; options are passed to `parse()`
obj = JSURL.tryParse(str[, default][, options]);
JSURL uses the allowable characters in URI schemes for multiple purposes depending on the location in the result. Some examples:
!
starts an array if it is the first character in a value, but inside a string it is unchanged.~
and )
are used as end-of-value and end-of-object delimiters, and are illegal inside encoded values.*
starts a string, but can be left out if the first string character is a-z. Inside a string, it escapes special characters.JSURL has a short
mode, which omits the unnecessary ending delimiters. You can use this to save a few more bytes, but you won't be able to spot an encoded value on sight by the ending ~
.
Since browsers may choose to encode any character with URI escaping, and special characters are shown in URLs, no attempt is made to make v2 URI-neutral. Decoding will work no matter how many encodings happened, if you pass the deURI: true
option to the parser.
stringify
adds whitespace (post-process, too slow in parser code)parse
and stringify
undefined
winsnew JSURL
-based API to prepare custom encoding and dictionaryThis work is licensed under the MIT license.
FAQs
URL friendly JSON-like formatting and parsing
We found that jsurl2 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.