Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
This module provides a lightweight, fast, easy-to-use XML parser which generates a simplified object / array tree. This can be very useful for parsing XML configuration files and the like. It is 100% pure JavaScript and has no dependencies.
Use npm to install the module:
npm install pixl-xml
Then use require()
to load it in your code:
var XML = require('pixl-xml');
Parse some XML by passing a string to XML.parse()
:
var xml_string = '<?xml version="1.0"?><Document>' +
'<Simple>Hello</Simple>' +
'<Node Key="Value">Complex</Node>' +
'</Document>';
var doc = XML.parse( xml_string );
console.log( doc );
That would produce an object like the following:
{
"Simple": "Hello",
"Node": {
"Key": "Value",
"_Data": "Complex"
}
}
Note that the outermost element is omitted from the object (<Document>
in this case). Also, for complex elements that have both attributes (or sub-elements) and plain data, the plain data goes into a _Data
property. Multiple elements with the same name at the same level are converted to an array.
You can also pass in a path to an XML file on disk, and it'll be loaded, then parsed:
var config = XML.parse( 'conf/config.xml' );
console.log( config );
Parsing errors will be thrown as exceptions, so you'd better wrap parse()
calls in a try/catch for safety:
var doc = null;
try {
doc = XML.parse( 'my_xml_file.xml' );
}
catch (err) {
console.log("XML Parser Error: " + err);
}
console.log( doc );
You can pass an optional 2nd argument to parse()
, which can be an object containing any of the following properties:
This optional property, when set to true
, will cause all XML attributes to be kept separate in their own sub-object called _Attribs
for each element. For example, consider this snippet:
var xml_string = '<?xml version="1.0"?><Document>' +
'<Simple>Hello</Simple>' +
'<Node Key="Value">Complex</Node>' +
'</Document>';
var doc = XML.parse( xml_string, { preserveAttributes: true } );
console.log( doc );
With the preserveAttributes
flag set to true, this would produce the following object:
{
"Simple": "Hello",
"Node": {
"_Attribs": {
"Key": "Value"
},
"_Data": "Content"
}
}
Notice the Key
attribute of the <Node>
element is now kept in an _Attribs
sub-object. The only real purpose for this is if you expect to write the XML back out again (see Composing XML below).
This optional property, when set to true
, will cause all keys to be lower-cased as the XML is parsed. This affects both elements and attributes. Example:
var xml_string = '<?xml version="1.0"?><Document>' +
'<Simple>Hello</Simple>' +
'<Node Key="Value">Complex</Node>' +
'</Document>';
var doc = XML.parse( xml_string, { lowerCase: true } );
console.log( doc );
With the lowerCase
flag set to true, this would produce the following object:
{
"simple": "Hello",
"node": {
"key": "Value",
"_data": "Content"
}
}
Note that the values themselves are not touched -- only the keys are lower-cased.
To compose XML back to a string, call XML.stringify()
and pass in your pre-parsed XML object, and an outer wrapper element name. It helps to parse using the preserveAttributes option for this, as it will honor the _Attribs
sub-objects and convert them back into real XML attributes. Example:
var xml_string = XML.stringify( doc, 'Document' );
console.log( xml_string );
This would produce something like:
<?xml version="1.0"?>
<Document>
<Node Key="Value">Content</Node>
<Simple>Hello</Simple>
</Document>
Note that elements and attributes may lose their original ordering, as hashes have an undefined key order. However, to keep things consistent, they are both alphabetically sorted when serialized.
Here are a few utility functions you can use:
STRING encodeEntities( STRING )
This function will take a string, and encode the three standard XML entities, ampersand (&
), left-angle-bracket (<
) and right-angle-bracket (>
), into their XML-safe counterparts. It returns the result. Example:
var text = '<Hello>&<There>';
console.log( XML.encodeEntities(text) );
// Would output: <Hello>&<There>
STRING encodeAttribEntities( STRING )
This function does basically the same thing as encodeEntities, but it also includes encoding for single-quotes ('
) and double-quotes ("
). It is used for encoding an XML string for composing into an attribute value. It returns the result. Example:
var text = '<Hello>"&"<There>';
console.log( XML.encodeAttribEntities(text) );
// Would output: <Hello>"&"<There>
STRING decodeEntities( STRING )
This function decodes all the standard XML entities back into their original characters. This includes ampersand (&
), left-angle-bracket (<
), right-angle-bracket (>
), single-quote ('
) and double-quote ("
). It is used when parsing XML element and attribute values. Example:
var text = '<Hello>"&"<There>';
console.log( XML.decodeEntities(text) );
// Would output: <Hello>"&"<There>
ARRAY alwaysArray( MIXED )
This function will wrap anything passed to it into an array and return the array, unless the item passed is already an array, in which case it is simply returned verbatim.
var arr = XML.alwaysArray( maybe_array );
ARRAY hashKeysToArray( OBJECT )
This function returns all the hash keys as an array. Useful for sorting and then iterating over the sorted list.
var my_hash = { foo: "bar", baz: 12345 };
var keys = XML.hashKeysToArray( my_hash ).sort();
for (var idx = 0, len = keys.length; idx < len; idx++) {
var key = keys[idx];
// do something with key and my_hash[key]
}
BOOLEAN isaHash( MIXED )
This function returns true
if the provided argument is a hash (object), false
otherwise.
var my_hash = { foo: "bar", baz: 12345 };
var is_hash = XML.isaHash( my_hash );
BOOLEAN isaArray( MIXED )
This function returns true
if the provided argument is an array (or is array-like), false
otherwise.
var my_arr = [ "foo", "bar", 12345 ];
var is_arr = XML.isaArray( my_arr );
INTEGER numKeys( OBJECT )
This function returns the number of keys in the specified hash.
var my_hash = { foo: "bar", baz: 12345 };
var num = XML.numKeys( my_hash ); // 2
STRING firstKey( OBJECT )
This function returns the first key of the hash when iterating over it. Note that hash keys are stored in an undefined order.
var my_hash = { foo: "bar", baz: 12345 };
var key = XML.firstKey( my_hash ); // foo or baz
Copyright (c) 2004 - 2015 Joseph Huckaby
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
A simple module for parsing and composing XML.
The npm package pixl-xml receives a total of 8,970 weekly downloads. As such, pixl-xml popularity was classified as popular.
We found that pixl-xml demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.