Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
snailescape.js
Advanced tools
Parse a string similarly to sh, respecting common ANSI escapes and shell quoting
Snail escape is a simple javascript library that implements a sane subset of bash escaping, similar to the ANSI C standard for escapes.
Single quotes, double quotes, and space-separation of parts are supported. This is best explained through an example:
All of the following:
echo "hello world"
, echo hello\ world
, "echo" 'hello world'
Will be split into:
["echo", "hello world"]
\a
— Bell (0x07
)\b
— Backspace (0x08
)\t
— Tab (0x09
)\e
— Escape (0x1B
)\n
— Newline (0x0A
)\v
— Vertical tab (0x0B
)\f
— Form feed (0x0C
)\r
— Carriage return (0x0D
)\
— Space (0x20
)\"
— Double quote (0x22
)\'
— Single quote (0x27
)\\
— Backslash (0x5C
)\[0-7]{1,3}
— Octal ASCII character\x[0-9a-f]{1,2}
— Hex ASCII characterNone of the above escapes apply within single quotes. All of the above escapes apply within double quotes or when not within quotes.
Escaping a space character or single quote characer is entirely redundant within double quotes, but both may be done.
Any time the error
field of the output is set, the errorNdx
field is also
set to an integer indicating what offset is erroneous.
Snail escape has two modes of error handling:
This mode may be toggled by passing the argument {partial: true}
to the
constructor. It defaults to false.
Complete parse errors operates under the assumption that the given string should completely parse with no issues. It should have no trailing characters or mismatched quotes, and if it does that's an error.
Partial parse errors operates under the assumption that the string might be incomplete. this is useful if you are taking user-input as it is being typed and parsing it.
In this mode, it will return both an error and a 'complete' value. It is possible for a parse to be marked as not complete, and also not having any errors. If a parse is marked as incomplete and does have errors, that means there is no way for any added characters to make the arguments valid (e.g. if there is an invalid escape sequence).
In this mode, you must check both complete
and error
before you may safeuly use the result.
var result = parser.parse('"incomplete');
if(result.complete && !result.error) {
// okay to use result.parts
}
var parser = new SnailEscape();
var result = parser.parse("echo hello world");
if(result.error) {
console.error("could not parse input: ", result.error);
} else {
console.log("All done! You typed the below array (as json): ")
console.log(JSON.stringify(result.parts));
}
var parser = new SnailEscape({partial: true});
var result = parser.parse("'arg1' 'arg\\n2' arg\\n3 arg4 arg5");
if(result.error) {
console.log("This will never parse! Backspace now (starting at character " + result.error.index);
} else if(!result.complete) {
console.log("Keep typing...");
} else if(result.complete && !result.error) {
console.log("All done! You typed the below array (as json): ")
console.log(JSON.stringify(result.parts));
}
Welcome, though please add tests and make sure that npm test
passes.
Apache 2.0
FAQs
Parse a string similarly to sh, respecting common ANSI escapes and shell quoting
We found that snailescape.js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.