Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
An RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.
The uri-js package is a utility for working with URIs (Uniform Resource Identifiers) in JavaScript. It provides functions for parsing, serializing, normalizing, and resolving URIs, as well as working with individual URI components.
Parsing URIs
This feature allows you to parse a URI string into its components, such as scheme, authority, path, query, and fragment.
const URI = require('uri-js');
const parsedURI = URI.parse('https://example.com:8080/path?query=string#fragment');
Serializing URIs
This feature allows you to build a URI string from its individual components.
const URI = require('uri-js');
const components = {
scheme: 'https',
userinfo: 'user:pass',
host: 'example.com',
port: 8080,
path: '/path',
query: 'query=string',
fragment: 'fragment'
};
const serializedURI = URI.serialize(components);
Normalizing URIs
This feature allows you to normalize a URI by converting it to its canonical form, which is useful for URI comparison.
const URI = require('uri-js');
const normalizedURI = URI.normalize('HTTP://EXAMPLE.COM:80/a/../b/./c%2f?%61');
Resolving URIs
This feature allows you to resolve a relative URI against a base URI, resulting in an absolute URI.
const URI = require('uri-js');
const baseURI = 'http://example.com/dir/';
const relativeURI = '../other';
const resolvedURI = URI.resolve(baseURI, relativeURI);
The url-parse package offers similar functionalities for parsing and handling URLs. It provides a more straightforward API for parsing URLs and has additional features for working with query strings.
This package implements the URL standard as specified by the WHATWG (Web Hypertext Application Technology Working Group). It is designed to mimic the URL class available in modern web browsers, providing a comprehensive API for working with URLs.
URI.js is an RFC 3986 compliant, scheme extendable URI parsing/validating/resolving library for all JavaScript environments (browsers, Node.js, etc). It is also compliant with the IRI (RFC 3987), IDNA (RFC 5890), IPv6 Address (RFC 5952), IPv6 Zone Identifier (RFC 6874) specifications.
URI.js has an extensive test suite, and works in all (Node.js, web) environments. It weighs in at 6.4kb (gzipped, 17kb deflated).
URI.parse("uri://user:pass@example.com:123/one/two.three?q1=a1&q2=a2#body");
//returns:
//{
// scheme : "uri",
// userinfo : "user:pass",
// host : "example.com",
// port : 123,
// path : "/one/two.three",
// query : "q1=a1&q2=a2",
// fragment : "body"
//}
URI.serialize({scheme : "http", host : "example.com", fragment : "footer"}) === "http://example.com/#footer"
URI.resolve("uri://a/b/c/d?q", "../../g") === "uri://a/g"
URI.normalize("HTTP://ABC.com:80/%7Esmith/home.html") === "http://abc.com/~smith/home.html"
URI.equal("example://a/b/c/%7Bfoo%7D", "eXAMPLE://a/./b/../b/%63/%7bfoo%7d") === true
//IPv4 normalization
URI.normalize("//192.068.001.000") === "//192.68.1.0"
//IPv6 normalization
URI.normalize("//[2001:0:0DB8::0:0001]") === "//[2001:0:db8::1]"
//IPv6 zone identifier support
URI.parse("//[2001:db8::7%25en1]");
//returns:
//{
// host : "2001:db8::7%en1"
//}
//convert IRI to URI
URI.serialize(URI.parse("http://examplé.org/rosé")) === "http://xn--exampl-gva.org/ros%C3%A9"
//convert URI to IRI
URI.serialize(URI.parse("http://xn--exampl-gva.org/ros%C3%A9"), {iri:true}) === "http://examplé.org/rosé"
All of the above functions can accept an additional options argument that is an object that can contain one or more of the following properties:
scheme
(string)
Indicates the scheme that the URI should be treated as, overriding the URI's normal scheme parsing behavior.
reference
(string)
If set to "suffix"
, it indicates that the URI is in the suffix format, and the validator will use the option's scheme
property to determine the URI's scheme.
tolerant
(boolean, false)
If set to true
, the parser will relax URI resolving rules.
absolutePath
(boolean, false)
If set to true
, the serializer will not resolve a relative path
component.
iri
(boolean, false)
If set to true
, the serializer will unescape non-ASCII characters as per RFC 3987.
unicodeSupport
(boolean, false)
If set to true
, the parser will unescape non-ASCII characters in the parsed output as per RFC 3987.
domainHost
(boolean, false)
If set to true
, the library will treat the host
component as a domain name, and convert IDNs (International Domain Names) as per RFC 5891.
URI.js supports inserting custom scheme dependent processing rules. Currently, URI.js has built in support for the following schemes:
URI.equal("HTTP://ABC.COM:80", "http://abc.com/") === true
URI.equal("https://abc.com", "HTTPS://ABC.COM:443/") === true
URI.parse("wss://example.com/foo?bar=baz");
//returns:
//{
// scheme : "wss",
// host: "example.com",
// resourceName: "/foo?bar=baz",
// secure: true,
//}
URI.equal("WS://ABC.COM:80/chat#one", "ws://abc.com/chat") === true
URI.parse("mailto:alpha@example.com,bravo@example.com?subject=SUBSCRIBE&body=Sign%20me%20up!");
//returns:
//{
// scheme : "mailto",
// to : ["alpha@example.com", "bravo@example.com"],
// subject : "SUBSCRIBE",
// body : "Sign me up!"
//}
URI.serialize({
scheme : "mailto",
to : ["alpha@example.com"],
subject : "REMOVE",
body : "Please remove me",
headers : {
cc : "charlie@example.com"
}
}) === "mailto:alpha@example.com?cc=charlie@example.com&subject=REMOVE&body=Please%20remove%20me"
URI.parse("urn:example:foo");
//returns:
//{
// scheme : "urn",
// nid : "example",
// nss : "foo",
//}
URI.parse("urn:uuid:f81d4fae-7dec-11d0-a765-00a0c91e6bf6");
//returns:
//{
// scheme : "urn",
// nid : "uuid",
// uuid : "f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
//}
To load in a browser, use the following tag:
<script type="text/javascript" src="uri-js/dist/es5/uri.all.min.js"></script>
To load in a CommonJS/Module environment, first install with npm/yarn by running on the command line:
npm install uri-js
# OR
yarn add uri-js
Then, in your code, load it using:
const URI = require("uri-js");
If you are writing your code in ES6+ (ESNEXT) or TypeScript, you would load it using:
import * as URI from "uri-js";
Or you can load just what you need using named exports:
import { parse, serialize, resolve, resolveComponents, normalize, equal, removeDotSegments, pctEncChar, pctDecChars, escapeComponent, unescapeComponent } from "uri-js";
URN parsing has been completely changed to better align with the specification. Scheme is now always urn
, but has two new properties: nid
which contains the Namspace Identifier, and nss
which contains the Namespace Specific String. The nss
property will be removed by higher order scheme handlers, such as the UUID URN scheme handler.
The UUID of a URN can now be found in the uuid
property.
URI validation has been removed as it was slow, exposed a vulnerabilty, and was generally not useful.
The errors
array on parsed components is now an error
string.
FAQs
An RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.
The npm package uri-js receives a total of 32,811,218 weekly downloads. As such, uri-js popularity was classified as popular.
We found that uri-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.