Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Convert classes into factory functions so they can be called with or without new.
Convert classes into factory functions.
Allows ES6 classes to be instantiated with or without new
.
Allows your API consumers to not need to divine (there's no built-in way to know) which functions you intend to be called with new
, and which functions are to be called without.
to-factory
Must call a class with new
, cannot call class as a function:
class Person {
constructor(name) {
this.name = name
}
}
new Person('alice') // ok
Person('bob') // TypeError: Cannot call a class as a function
to-factory
Call a class with new
or as a function:
// exact same Person class as above example
Person = toFactory(Person)
const personA = new Person('created with new')
console.log(personA.name) // => 'created with new'
const personB = Person('created without new')
console.log(personB.name) // => 'created without new'
Inheritance, etc all works as expected
// Inheritance works as expected
class BigPerson extends Person {
constructor(name) {
super(name.toUpperCase())
}
})
BigPerson = toFactory(BigPerson)
const bigPersonA = new BigPerson('created with new')
console.log(bigPersonA.name) // => 'CREATED WITH NEW'
const bigPersonB = BigPerson('created without new')
console.log(bigPersonB.name) // => 'CREATED WITHOUT NEW'
The "can't call without new" restriction on ES6 classes create a needless incompatibility between tools which accept classes and tools which accept regular functions – there is no built-in means for a tol to determine whether a function wants be called with new or without new, it just has to pick one and hope for the best.
While it's true that some real-world functions insist on being constructors in much the same way, at least it is possible to patch the library and/or submit a pull request explaining that requiring new is uneccessarily rigid and provides little benefit when it's entirely possible to transparently handle both cases. With ES6 classes we have no option to just patch the library as this rigidity is baked right into the implementation.
MIT
FAQs
Convert classes into factory functions so they can be called with or without new.
The npm package to-factory receives a total of 14,203 weekly downloads. As such, to-factory popularity was classified as popular.
We found that to-factory demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.