Comparing version 1.0.5 to 2.0.0
{ | ||
"name": "slashes", | ||
"version": "1.0.5", | ||
"description": "Add or strip backslashes.", | ||
"main": "slashes.js", | ||
"scripts": { | ||
"test": "echo \"Error: no test specified\" && exit 1" | ||
"version": "2.0.0", | ||
"license": "ISC", | ||
"author": { | ||
"name": "Chris Ackerman", | ||
"email": "chris@topher.land" | ||
}, | ||
"repository": { | ||
"type": "git", | ||
"url": "git://github.com:ChrisAckerman/node-slashes" | ||
"url": "git://github.com:ChrisAckerman/slashes" | ||
}, | ||
"main": "lib-commonjs/index.js", | ||
"module": "lib/index.js", | ||
"files": [ | ||
"README.md", | ||
"css/", | ||
"dist/", | ||
"lib-commonjs/", | ||
"lib/", | ||
"scss/" | ||
], | ||
"scripts": { | ||
"start": "run-script build:commonjs && node ./lib-commonjs/repl.js", | ||
"test": "run-script eslint && run-script tsc --noEmit && run-script jest", | ||
"clean": "del-cli lib lib-commonjs dist css coverage && jest --clearCache", | ||
"build": "run-script clean && run-script build:js && run-script build:commonjs && run-script build:d.ts && run-script build:cleanup", | ||
"build:cleanup": "del-cli \"lib?(-*)/**/@(__demo__|__snapshots__|?(*.)test.@(ts|tsx|js|jsx))\"", | ||
"build:commonjs": "cross-env NODE_ENV=production BABEL_MODULES=cjs babel src --out-dir lib-commonjs --extensions .ts,.tsx,.js,.jsx --copy-files --source-maps", | ||
"build:d.ts": "run-script tsc --emitDeclarationOnly && run-script tsc --emitDeclarationOnly --outDir lib-commonjs", | ||
"build:js": "cross-env NODE_ENV=production BABEL_MODULES=false babel src --out-dir lib --extensions .ts,.tsx,.js,.jsx --copy-files --source-maps", | ||
"eslint": "eslint \"src/**/*.{js,jsx,ts,tsx}\" --ignore-pattern \"/__demo__/\" --no-error-on-unmatched-pattern", | ||
"jest": "cross-env NODE_ENV=test jest --passWithNoTests", | ||
"prepack": "run-script build", | ||
"reformat": "run-script eslint --fix --quiet", | ||
"tsc": "tsc" | ||
}, | ||
"devDependencies": { | ||
"@babel/cli": "^7.8.4", | ||
"@babel/core": "^7.8.4", | ||
"@babel/generator": "^7.8.4", | ||
"@babel/plugin-proposal-class-properties": "^7.8.3", | ||
"@babel/plugin-proposal-decorators": "^7.8.3", | ||
"@babel/plugin-proposal-object-rest-spread": "^7.8.3", | ||
"@babel/plugin-transform-typescript": "^7.8.3", | ||
"@babel/preset-env": "^7.8.4", | ||
"@types/jest": "^25.1.3", | ||
"@types/node": "^13.7.4", | ||
"@typescript-eslint/eslint-plugin": "^2.21.0", | ||
"@typescript-eslint/parser": "^2.21.0", | ||
"@xornot/run-script": "^0.1.2", | ||
"babel-core": "^7.0.0-bridge.0", | ||
"babel-jest": "^25.1.0", | ||
"babel-plugin-const-enum": "^0.0.5", | ||
"cross-env": "^7.0.0", | ||
"del-cli": "^3.0.0", | ||
"eslint": "^6.8.0", | ||
"eslint-config-prettier": "^6.10.0", | ||
"eslint-plugin-prettier": "^3.1.2", | ||
"eslint-plugin-react": "^7.18.3", | ||
"jest": "^25.1.0", | ||
"prettier": "^1.19.1", | ||
"typescript": "^3.8.2" | ||
}, | ||
"keywords": [ | ||
"add", | ||
"escape", | ||
"unescape", | ||
"slashes", | ||
"php", | ||
"strip", | ||
"remove", | ||
"sequence", | ||
"encode", | ||
"decode", | ||
"backslash", | ||
"slash", | ||
"backslash", | ||
"escape", | ||
"unescape", | ||
"php" | ||
], | ||
"author": "Chris Ackerman <bluejeansandrain@gmail.com>", | ||
"license": "MIT", | ||
"bugs": { | ||
"url": "https://github.com/ChrisAckerman/node-slashes/issues" | ||
}, | ||
"homepage": "https://github.com/ChrisAckerman/node-slashes" | ||
"unicode", | ||
"ascii", | ||
"utf8", | ||
"utf16", | ||
"control", | ||
"char", | ||
"character", | ||
"unprintable", | ||
"printable", | ||
"codepoint", | ||
"codeblock", | ||
"supplemental", | ||
"supplementary" | ||
] | ||
} |
171
README.md
@@ -1,96 +0,141 @@ | ||
# slashes | ||
# Slashes | ||
Add or strip backslashes. | ||
Provides two methods, `add` and `strip` which are almost the same as PHP's `addslashes` and `stripslashes` functions | ||
respectively. | ||
If you were previously using v1, see the [migration](./MIGRATION.md) document for guidance on switching to v2. | ||
The `add` method will prefix backslash (`\`), double quote (`"`), and single quote (`'`) characters with backslashes. | ||
Null (`\0`) characters will be replaced with backslash zero `"\\0"`, and newline (`\n`) characters will be replaced with | ||
`"\\n"`. The newline replacement differs from PHP because JavaScript has ASI (auto semicolon insertion) at the end of | ||
each line, so a newline in a JavaScript string literal does not preserve the newline character correctly. | ||
# Getting Started | ||
The `strip` method replaces all sequences of two characters that start with a backslash, with the second character in | ||
the sequence. There are three caveats. A single non-escaped slash at the end of the string will be removed. Backslash | ||
zero `"\\0"` will become a null (`\0`) character. Backslash 'n' `"\\n"` will become a newline (`\n`) character. | ||
```ts | ||
import { addSlashes, stripSlashes } from 'slashes'; | ||
// Or using CommonJS require. | ||
const { addSlashes, stripSlashes } = require('slashes'); | ||
The goal of this utility is to make a string safe for concatenation or injection into JavaScript source. | ||
```js | ||
var foo = "\\bar"; | ||
var source = "console.log('" + bar + "');"; | ||
eval(source); | ||
addSlashes(`foo\nbar`) === `foo\\nbar`; // true | ||
stripSlashes(`foo\\nbar`) === `foo\nbar`; // true | ||
``` | ||
You might expect the above snippet to output `\bar` but instead you will see `ar`, because the source string ends up | ||
being `console.log('\bar');` which is interpreted as starting with an escaped "b" rather than a backslash and then a | ||
"b". It can be fixed using the `add` method. | ||
You can also experiment using a pre-configured REPL by running the `npm start` command. | ||
```js | ||
var foo = "\\bar"; | ||
var source = "console.log('" + slashes.add(bar) + "');"; | ||
eval(source); | ||
# API | ||
## Adding Slashes | ||
### **Function** `addSlashes(str: string): string` | ||
Returns a string with the following default characters escaped: | ||
- backspace (`"\b"` -> `"\\b"`) | ||
- form feed (`"\f"` -> `"\\f"`) | ||
- newline (`"\n"` -> `"\\n"`) | ||
- carriage return (`"\r"` -> `"\\r"`) | ||
- horizontal tab (`"\t"` -> `"\\t"`) | ||
- vertical tab (`"\v"` -> `"\\v"`) | ||
- null (`"\0"` -> `"\\0"`) | ||
- single quote (`"'"` -> `"\\'"`) | ||
- double quote (`"\""` -> `"\\\""`) | ||
- backslash (`"\\"` -> `"\\\\"`) | ||
All `addSlashes` overloads use the above as the default character set to escape if no explicit character set is given. | ||
```ts | ||
addSlashes(`\b\f\n\r\t\v\0'"\\`) === `\\b\\f\\n\\r\\t\\v\\0\\'\\"\\\\`; // true | ||
``` | ||
Now the source comes out as `console.log('\\bar');` and the output will be `\bar`. | ||
### **Function** `addSlashes(str: string, characters: string): string` | ||
## Install | ||
An `addSlashes` overload which returns a string with _only_ the characters in the `characters` string escaped. The explicit characters completely override the default character set. The default characters string is: `"\b\f\n\r\t\v\0'\"\\"`. | ||
```sh | ||
npm install slashes --save | ||
```ts | ||
addSlashes(`foo\nbar`, `oa`) === `f\\o\\o\nb\\ar`; // true | ||
``` | ||
## Usage | ||
Characters in the unicode supplementary range (code points > 65535) are _always_ converted to a unicode escape surrogate pairs. This is because Javascript strings are UTF-16, which actually sees these as two characters (`"😊".length === 2`). So, using 😊 in the `characters` string is actually setting two escapable characters which are _not valid individually._ If the "😊" character were not escaped to two unicode escape sequences, you would end up with a string containing invalid characters which would print like this: `"\\�\\�"`, instead of valid characters: `"\\ud83d\\ude0a"`. | ||
```ts | ||
addSlashes(`foo😊bar`, `😊`) === `foo\\ud83d\\ude0abar`; // true | ||
``` | ||
slashes.add(string, [number]) | ||
slashes.strip(string, [number]) | ||
### **Function** `addSlashes(str: string, count: number): string` | ||
An `addSlashes` overload which returns a string with `count` layers of slashes added to the default escape character set. This is the same as recursively invoking this function `count` times. | ||
```ts | ||
addSlashes(`"foo\nbar"`, 2) === `\\\\\\"foo\\\\nbar\\\\\\"`; // true | ||
addSlashes(addSlashes(`"foo\nbar"`)) === `\\\\\\"foo\\\\nbar\\\\\\"`; // true | ||
addSlashes(`"foo\nbar"`, 2) === addSlashes(addSlashes(`"foo\nbar"`)); // true | ||
``` | ||
If a non-string value is passed as the first parameter, it will be coerced to a string. | ||
### **Function** `addSlashes(str: string, count: number, characters: string): string` | ||
If a non-number is passed as the second parameter, it will be coerced to a number. Negative numbers are equivalent to | ||
their positive counter parts. Zero is the same as one. | ||
An `addSlashes` overload which accepts both a `count` and `characters` parameter. | ||
### Examples | ||
```js | ||
var slashes = require('slashes'); | ||
### **Function** `addSlashes(str: string, options: IAddSlashesOptions): string` | ||
var test = "'test'\n\"ing\"\0"; | ||
var added = slashes.add(test); | ||
var stripped = slashes.strip(added); | ||
An `addSlashes` overload which accepts an options object. | ||
console.log("test:\n%s\n", test); | ||
console.log("added:\n%s\n", added); | ||
console.log("stripped:\n%s\n", stripped); | ||
- `options` Configurable options for adding slashes to a string. Can have the following fields: | ||
- `count` Number of times to add slashes to the string. | ||
- `characters` A string of characters that should be escaped with slashes. | ||
- `escapeNonAscii` When true, all non-ASCII characters (unicode code points > 127) will be converted to `\x` or `\u` escape sequences. | ||
```ts | ||
addSlashes(`†©`, { count: 2, characters: `†©\\`, escapeNonAscii: true }) === `\\\\u2020\\\\xa9`; // true | ||
``` | ||
Output should be... | ||
## Stripping Slashes | ||
### **Function** `stripSlashes(str: string): string` | ||
Returns a string with one layer of slashes removed. It will convert all ES6 escape sequences into their corresponding characters. Slashes which are not part of a recognized escape sequence are removed, and the following character is left in place. | ||
```ts | ||
stripSlashes(`\\b\\f\\n\\r\\t\\v\\0\\xa9\\u2020\\u{1f60a}\\a\\\\`) === `\b\f\n\r\t\v\0©†😊a\\`; // true | ||
``` | ||
test: | ||
'test' | ||
"ing" | ||
added: | ||
\'test\' | ||
\"ing\"\0 | ||
If a `\u{...}` escape sequence has a code point greater than 0x10ffff, the slash is removed and the `u{...}` suffix is left as a literal string. | ||
stripped: | ||
'test' | ||
"ing" | ||
```ts | ||
stripSlashes(`\\u{110000}`) === `u{110000}`; // true | ||
``` | ||
### **Function** `stripSlashes(str: string, count: number): string` | ||
A `stripSlashes` overload which returns a string with `count` layers of slashes removed. This is the same as recursively invoking this function `count` times. | ||
```ts | ||
stripSlashes(`\\\\n\\\\a\\\\\\\\`, 2) === `\na\\`; // true | ||
stripSlashes(stripSlashes(`\\\\n\\\\a\\\\\\\\`)) === `\na\\`; // true | ||
stripSlashes(`\\\\n\\\\a\\\\\\\\`, 2) === stripSlashes(stripSlashes(`\\\\n\\\\a\\\\\\\\`)); // true | ||
``` | ||
Both methods also take an optional second number parameter, 1 or greater. This is equivalent to calling the method | ||
that many times. | ||
```js | ||
slashes.add(string, 2); | ||
// ...is the same as... | ||
slashes.add(slashes.add(string)); | ||
### **Function** `stripSlashes(str: string, options: IStripSlashesOptions): string` | ||
slashes.strip(string, 2); | ||
// ...is the same as... | ||
slashes.strip(slashes.strip(string)); | ||
A `stripSlashes` overload which accepts an options object. | ||
- `options` Configurable options for stripping slashes from a string. Can have the following fields: | ||
- `count` Number of times to strip slashes from the string. | ||
- `defaultEscapeValue` The default value for all escape options (b, f, n, r, t, v, 0, x, u, and uEs6). When true, escape options must be explicitly disabled. When false, escape options must be explicitly enabled. Defaults to true. | ||
- `b` True to convert `"\\b"` escapes into backspace characters. Defaults to `defaultEscapeValue`. | ||
- `f` True to convert `"\\f"` escapes into form feed characters. Defaults to `defaultEscapeValue`. | ||
- `n` True to convert `"\\n"` escapes into newline (line feed) characters. Defaults to `defaultEscapeValue`. | ||
- `r` True to convert `"\\r"` escapes into carriage return characters. Defaults to `defaultEscapeValue`. | ||
- `t` True to convert `"\\t"` escapes into horizontal tab characters. Defaults to `defaultEscapeValue`. | ||
- `v` True to convert `"\\v"` escapes into vertical tab characters. Defaults to `defaultEscapeValue`. | ||
- `0` True to convert `"\\0"` escapes into null characters. Defaults to `defaultEscapeValue`. | ||
- `x` True to convert `"\\x##"` escapes (where `##` is a hex single byte unicode code point) into unicode characters. Defaults to `defaultEscapeValue`. | ||
- `u` True to convert `"\\u####"` escapes (where `####` is a hex two byte unicode code point) into unicode characters. Defaults to `defaultEscapeValue`. | ||
- `uEs6` True to convert `"\\u{#...}"` escapes (where `#...` is a hex unicode code point) into unicode characters. Defaults to `u`. | ||
If an escape option is false, then the corresponding escape sequence will be treated like any other backslash before a non-escape character. The backslash will be removed, and all trailing characters left untouched. | ||
```ts | ||
stripSlashes(`\\\\tfoo\\\\nbar`, { | ||
// Strip slashes twice. | ||
count: 2, | ||
// All escape sequences are disabled by default. | ||
defaultEscapeValue: false, | ||
// Enable newlines escapes explicitly. | ||
n: true | ||
}) === `tfoo\nbar`; // true | ||
``` | ||
Note that in JavaScript, `"\0"` and `"\u0000"` are identical. The `add` method will convert both to `"\\0"`. |
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
Major refactor
Supply chain riskPackage has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.
Found 1 instance in 1 package
New author
Supply chain riskA new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.
Found 1 instance in 1 package
Debug access
Supply chain riskUses debug, reflection and dynamic code execution features.
Found 1 instance in 1 package
No bug tracker
MaintenancePackage does not have a linked bug tracker in package.json.
Found 1 instance in 1 package
No website
QualityPackage does not have a website.
Found 1 instance in 1 package
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
No tests
QualityPackage does not have any tests. This is a strong signal of a poorly maintained or low quality package.
Found 1 instance in 1 package
77255
38
732
142
25
1
2
2