Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
style-search
Advanced tools
The style-search npm package is a utility for searching through CSS-like strings. It allows you to find specific patterns, such as selectors, properties, and values, within a CSS string. This can be particularly useful for building tools that need to analyze or transform CSS code.
Search for Selectors
This feature allows you to search for CSS selectors within a CSS string. In the example, it searches for the '.' character, which indicates the start of a class selector, and logs the index where each selector is found.
const styleSearch = require('style-search');
const css = '.class1 { color: red; } .class2 { color: blue; }';
styleSearch({ source: css, target: '.' }, (match) => {
console.log('Found selector at index:', match.startIndex);
});
Search for Properties
This feature allows you to search for specific CSS properties within a CSS string. In the example, it searches for the 'color' property and logs the index where each occurrence is found.
const styleSearch = require('style-search');
const css = '.class1 { color: red; } .class2 { color: blue; }';
styleSearch({ source: css, target: 'color' }, (match) => {
console.log('Found property at index:', match.startIndex);
});
Search for Values
This feature allows you to search for specific CSS values within a CSS string. In the example, it searches for the 'red' value and logs the index where each occurrence is found.
const styleSearch = require('style-search');
const css = '.class1 { color: red; } .class2 { color: blue; }';
styleSearch({ source: css, target: 'red' }, (match) => {
console.log('Found value at index:', match.startIndex);
});
PostCSS is a tool for transforming CSS with JavaScript plugins. It provides a more comprehensive set of features compared to style-search, including parsing, transforming, and stringifying CSS. While style-search is focused on searching within CSS strings, PostCSS allows for more complex manipulations and transformations.
CSS-tree is a tool for working with CSS, including parsing, generating, and analyzing CSS code. It offers more advanced features than style-search, such as building and traversing an Abstract Syntax Tree (AST) for CSS. This makes it suitable for more complex tasks that go beyond simple string searches.
CSSTree Validator is a tool for validating CSS syntax and structure. It provides functionality for checking the correctness of CSS code, which is not a feature of style-search. While style-search is useful for finding specific patterns, CSSTree Validator ensures that the CSS code adheres to standards.
Search CSS (and CSS-like) strings, with sensitivity to whether matches occur inside strings, comments, and functions.
var styleSearch = require('style-search');
styleSearch(options, callback);
By default, the search ignores strings, comments, and function names. You can use the options to change this behavior or introduce other restrictions. That is what makes this module more useful for many searches than indexOf()
or a RegExp
.
However, if you need more detailed parsing, you should consider using the real parsers PostCSS, postcss-selector-parser
, and postcss-value-parser
.
/* Here is some pink */
a { color: pink; }
a::before { content: "pink" }
b { color: shadesOfPink(7); }
styleSearch({
source: theCssStringAbove,
target: "pink",
}, function(match, count) {
/* Only the "pink" in `color: pink` will be
reported as a match */
});
For every match found your callback
is invoked. It is passed two arguments:
match
object with the following properties:
startIndex
: where the match beginsendIndex
: where the match endstarget
: what got matched (useful if your target
option is an array instead of a single string)insideFunctionArguments
: whether the match is inside a function — this includes the parentheses around the argumentsinsideComment
: whether the match is inside a commentinsideString
: whether the match is inside a stringBelow you'll see that syntax feature options all accept three keywords: "skip"
, "check"
, "only"
. An error will be thrown if you use "only"
more than once.
String. Required.
The source string to search through.
String or array of strings. Required.
The target of the search. Can be
match
object passed to the callback
will differentiate which string in the array got matched via its target
property)Boolean. Default: false
.
If true
, the search will stop after one match is found.
"skip"
| "check"
| "only"
. Default: "skip"
.
This includes both standard /* CSS comments */
and non-standard but widely used // single line comments
.
"skip"
| "check"
| "only"
. Default: "skip"
.
"skip"
| "check"
| "only"
. Default: "skip"
.
"skip"
| "check"
| "only"
. Default: "check"
.
"skip"
| "check"
| "only"
. Default: "check"
.
This designates anything inside parentheses, which includes standard functions, but also Sass maps and other non-standard constructs. parentheticals
is a broader category than functionArguments
.
0.1.0
FAQs
Search CSS(-like) strings
We found that style-search demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.