Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Lightweight and extensible math-like expression parser and compiler.
xex.js is a lightweight library that provides API to parse mathematic-like expressions and to compile them into javascript functions of user-provided signatures. The library was designed to be small, hackable, and embeddable in other projects - it has no dependencies and all functionality fits into a single file. It was primarily designed for xschema library to provide support for expression constraints and access control rules, but since the library has much more use-cases it was separated from the original project.
The expression is internally represented as AST, unlike many other expression evaluators that use postfix notation. The reason to use AST was to make the library friendly for implementing new features. The library currently provides nearly full access to JS Math
functionality with some additional features. It treats all variables as numbers and is currently designed to work only with numbers - that's it, no user-defined types, objects, etc...
The library can be probably extended in the future to provide more built-in functions and features - pull requests that add useful functionality to xex
are more than welcome!
Simple example:
const xex = require("xex");
// Create the `Expression` instance:
const exp = xex.exp("sin(x) * cos(y)");
console.log(exp instanceof xex.Expression);
// Root node of the expression's AST.
// {
// type: "Binary",
// name: "*",
// info: {...},
// left: {
// type: "Call",
// name: "sin" ,
// info: {...} ,
// args: [...] }
// },
// right: {
// type: "Call",
// name: "cos" ,
// info: {...} ,
// args: [...] }
// }
// }
console.log(exp.root);
// Map of all variables the expression uses:
// {
// x: <node> ,
// y: <node>
// }
console.log(exp.vars);
// Call the compiled function with `args`:
// 0.46452135963892854
const args = { x: 0.5, y: 0.25 };
console.log(exp.eval(args));
// The default compiled function is not bound to the
// expression, you can steal it and use it anywhere:
// 0.46452135963892854
const f = exp.eval;
console.log(f({ x: 0.5, y: 0.25 }));
By default the compiled expression expects a single argument, which is an object where each property describes a variable inside the expression. Expressions are not static in most cases and there are currently two ways of checking whether the expression contains invalid variables:
exp.vars
after the expression was parsed (ideal for inspecting)For example if the expression can use only variables x
and y
it's better to use the whitelise:
// Values don't matter, only keys are important.
const whitelist = { x: true, y: 0 };
const exp0 = xex.exp("sin(x) * cos(y)", { varsWhitelist: whitelist }); // Ok.
const exp1 = xex.exp("sin(z) * cos(w)", { varsWhitelist: whitelist }); // Throws ExpressionError.
If you need a different signature, for example a function where the first parameter is x
and the second parameter y
, you can compile it as well:
const exp = xex.exp("sin(x) * cos(y)");
const fn = exp.compile(["x", "y"]);
console.log(fn(0.5, 0.25));
When the expression is compiled this way it checks all variables and will throw if it uses a variable that is not provided. The xex.exp()
may throw as well, so it's always a good practice to enclose it in try-catch
block:
var fn;
try {
fn = xex.exp("sin(x) * cos(y) + z").compile(["x", "y"]);
}
catch (ex) {
// Exception should always be `ExpressionError` instance.
console.log(ex instanceof xex.ExpressionError);
// ERROR: Variable 'z' used, but no mapping provided
console.log(`ERROR: ${ex.message}`);
}
The ExpressionError
instance also contains a position
, which describes where the error happened if it was a parser error:
try {
xex.exp("a : b");
}
catch (ex) {
// ERROR: Unexpected token ':' at 2
console.log(`ERROR: ${ex.message} at ${ex.position}`);
}
The position
describes an index of the first token character from the beginning of the input. If the expression has multiple lines then you have to count lines and columns manually.
By default the expression is simplified (constant folding). If you intend to process the expression tree and would like to see all nodes you can disable it, or trigger it manually:
// Create the `Expression` instance without a constant folding pass.
const exp = xex.exp("sin(0.6) + cos(0.5) + x", { noFolding: true });
// Traverse the parsed expression tree.
// {
// ...
// }
console.log(JSON.stringify(exp.root, null, 2));
// Trigger constant folding manually - you can substitude variables with constants.
exp.fold({ x: 1 });
// 2.442225035285408
console.log(JSON.stringify(exp.root, null, 2));
The library can be extended by user-defined constants, operators, and functions. The base environment xex
is frozen and cannot be extended, however, it can be cloned and the clone can be then used the same way as xex
:
// Clone the base environment and add some constants (can be chained).
const env = xex.clone()
.addConstant({ name: "ONE", value: 0 })
.addConstant("ANSWER_TO_LIFE", 42) // Simplified syntax.
// Adding functions always require passing the definition:
env.addFunction({
name: "sum" // Required: Function name, must be a valid identifier name.
args: 1, // Required: Number of arguments or minimum number of arguments.
amax: Infinity // Optional: Maximum number of arguments, can be Infinity.
safe: true, // Optional: Evaluation has no side effects (default false).
eval: function() {
var x = 0;
for (var i = 0; i < arguments.length; i++)
x += arguments[i];
return x;
}
});
// The custom environment `env` acts as `xex`:
// 43
const exp = env.exp("sum(ANSWER_TO_LIFE, ONE)")
console.log(exp.eval());
The safe
option is pessimistic by default (false), so it's a good practice to always provide it depending on the function you are adding. If your custom function has side effects or returns a different answer every time it's called (like Math.random()
) then it must not be considered safe. Safe functions can be evaluated by constant folding of all their arguments are known (constants or already folded expressions).
Extending operators is similar to extending functions with some minor differences: operators associativity and precedence:
const env = xex.clone();
// Use addUnary() or addBinary() to add new operators.
env.addBinary({
name: "**", // Required: Name - Cannot conflict with identifier characters.
prec: 2, // Required: Precedence - less means higher precedence.
rtl : true, // Optional: Associativity - Right (true) or left (false, default).
safe: true, // Optional: Evaluation has no side effects (default false).
eval: Math.pow
});
console.log(env.exp("2 ** 3" ).eval()); // 8
console.log(env.exp("2 ** 3 ** 2" ).eval()); // 512
console.log(env.exp("(2 ** 3) ** 2").eval()); // 64
-(x)
!(x)
x = y
x + y
x - y
x * y
x / y
x % y
x == y
x != y
x > y
x >= y
x < y
x <= y
condition ? taken : not-taken
isnan(x)
isinf(x)
isfinite(x)
isint(x)
issafeint(x)
isequal(x, y)
isequal(0, -0)
-> 0
isequal(42, 42)
-> 1
isequal(NaN, NaN)
-> 1
isbetween(x, min, max)
0
if x
is NaN
clamp(x, min, max)
NaN
if x
is NaN
sign(x)
sign(0)
-> 0
sign(-0)
-> -0
sign(NaN)
-> NaN
round(x)
round(2.5)
-> 3
trunc(x)
floor(x)
ceil(x)
abs(x)
exp(x)
expm1(x)
exp(x) - 1
, but more precise.log(x)
logp1(x)
log(x + 1)
, but more precise.log2(x)
log10(x)
sqrt(x)
cbrt(x)
frac(x)
sin(x)
cos(x)
tan(x)
sinh(x)
cosh(x)
tanh(x)
asin(x)
acos(x)
atan(x)
atan2(x, y)
asinh(x)
acosh(x)
atanh(x)
pow(x, y)
hypot(x, y)
min(x, y...)
and max(x, y...)
NaN
if one or more argument is NaN
minval(x, y...)
and maxval(x, y...)
NaN
values, only returns NaN
if all values are NaN
Infinity
NaN
PI = 3.14159265358979323846
FAQs
Lightweight and extensible math-like expression parser and compiler.
The npm package xex receives a total of 0 weekly downloads. As such, xex popularity was classified as not popular.
We found that xex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.