Security News
Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
W3C/WHATWG spec dependencies exploration companion. Features a short set of tools to study spec references as well as WebIDL term definitions and references found in W3C specifications.
Reffy is a Web spec crawler tool. It is notably used to update Webref every 6 hours.
The code features a generic crawler that can fetch Web specifications and generate machine-readable extracts out of them. Created extracts include lists of CSS properties, definitions, IDL, links and references contained in the specification.
To install Reffy, you need Node.js 14 or greater.
Reffy is available as an NPM package. To install the package globally, run:
npm install -g reffy
This will install Reffy as a command-line interface tool.
The list of specs crawled by default evolves regularly. To make sure that you run the latest version, use:
npm update -g reffy
Reffy crawls requested specifications and runs a set of processing modules on the content fetched to create relevant extracts from each spec. Which specs get crawled, and which processing modules get run depend on how the crawler gets called. By default, the crawler crawls all specs defined in browser-specs and runs all core processing modules defined in the browserlib
folder.
Crawl results will either be returned to the console or saved in individual files in a report folder when the --output
parameter is set.
Examples of information that can be extracted from the specs:
The crawler can be fully parameterized to crawl a specific list of specs and run a custom set of processing modules on them. For example:
reffy --spec fetch --module idl
reffy --spec html --module refs
reffy --spec css-flexbox-1 --module css
reffy --spec wai-aria-1.2 --module dfns
extract-editors.mjs
processing module and create individual spec extracts with the result of the processing under an editors
folder for all specs in browser-specs, run:
reffy --output reports/test --module editors:extract-editors.mjs
You may add --terse
(or -t
) to the above commands to access the extracts directly.
Run reffy -h
for a complete list of options and usage details.
Some notes:
.cache
subfolder in particular.reffy
width node reffy.js
in the above example to run Reffy.Additional CLI tools in the src/cli
folder complete the main specs crawler.
The WebIDL parser takes the relative path to an IDL extract and generates a JSON structure that describes WebIDL term definitions and references that the spec contains. The parser uses WebIDL2 to parse the WebIDL content found in the spec. To run the WebIDL parser: node src/cli/parse-webidl.js [idlfile]
To create the WebIDL extract in the first place, you will need to run the idl
module in Reffy, as in:
reffy --spec fetch --module idl > fetch.idl
The Parsed WebIDL generator takes the results of a crawl as input and applies the WebIDL parser to all specs it contains to create JSON extracts in an idlparsed
folder. To run the generator: node src/cli/generate-idlparsed.js [crawl folder] [save folder]
The WebIDL names generator takes the results of a crawl as input and creates a report per referenceable IDL name, that details the complete parsed IDL structure that defines the name across all specs. To run the generator: node src/cli/generate-idlnames.js [crawl folder] [save folder]
The crawl results merger merges a new JSON crawl report into a reference one. This tool is typically useful to replace the crawl results of a given specification with the results of a new run of the crawler on that specification. To run the crawl results merger: node src/cli/merge-crawl-results.js [new crawl report] [reference crawl report] [crawl report to create]
Starting with Reffy v5, analysis tools that used to be part of Reffy's suite of tools to study extracts and create human-readable reports of potential spec anomalies migrated to a companion tool named Strudy. The actual reports get published in a separate w3c/webref-analysis repository as well.
See the related WebIDLPedia project and its repo.
Reffy should be able to parse most of the W3C/WHATWG specifications that define CSS and/or WebIDL terms (both published versions and Editor's Drafts), and more generally speaking specs authored with one of Bikeshed or ReSpec. Reffy can also parse certain IETF specs to some extent, and may work with other types of specs as well.
Reffy crawls specs defined in w3c/browser-specs. If you believe a spec is missing, please check the Spec selection criteria and create an issue (or prepare a pull request) against the w3c/browser-specs repository.
Given some spec info, the crawler basically goes through the following steps:
The crawler processes 4 specifications at a time. Network and parsing errors should be reported in the crawl results.
The crawler reads parameters from the config.json
file. Optional parameters:
cacheRefresh
: set this flag to never
to tell the crawler to use the cache entry for a URL directly, instead of sending a conditional HTTP request to check whether the entry is still valid. This parameter is typically useful when developing Reffy's code to work offline.resetCache
: set this flag to true
to tell the crawler to reset the contents of the local cache when it starts.Authors so far are François Daoust and Dominique Hazaël-Massieux.
Additional ideas, bugs and/or code contributions are most welcome. Create issues on GitHub as needed!
The code is available under an MIT license.
FAQs
W3C/WHATWG spec dependencies exploration companion. Features a short set of tools to study spec references as well as WebIDL term definitions and references found in W3C specifications.
We found that reffy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.