Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
___ ___ _____ _______ _______
| | | _| || __||_ _|
|- -|| ||__ | | |
|___|___||_______||_______| |___|
XJST is a DSL for universal data transformations with compiler written on top of the Node.js and Ometa/JS and output code working in any browser or on server-side.
Yes, traverse any data in specific flow using matching against conditions set to generate any output (see binary tree prefixer).
For example, XJST can be used as:
XJST makes possible to extend your previous transformation by overriding or
specializing some of it's parts (example below is extending
this.url === '/login'
condition with redirection for logged in users).
XJST is a superset of JavaScript so you can use any popular libraries (that is jquery or underscore) within your transformation and write condition bodies in JavaScript.
Creating your own DSL based on XJST is also possible, because it's syntax parser is powered by ometajs.
Input:
template(this.url === '/')(function() {
return render('home page')
});
template(this.url === '/login')(function() {
return render('login form')
});
template(this.url === '/login', this.cookie.is_logined)(function() {
return redirect('user page')
});
Output (simplified):
switch (this.url) {
case '/login':
switch (this.cookie.is_logined) {
case true:
return redirect('user page')
default:
return render('login form')
}
case '/':
return render('home page')
}
npm install xjst
var xjst = require('xjst'),
fn = xjst.compile('template string', 'filename.xjst', options);
fn({ your: 'data' });
XJST extends JavaScript syntax with a following keywords: template
, local
,
apply
, applyNext
.
template(expression1 === value1, ... , expressionN === valueN)(function() {
// will be run if condition above equals to true
})
Multiple template
statements will be grouped to construct optimal conditions
graph. Order of the template
statements matters, the priority decreases from
the bottom to the top.
There're few restrictions for templates:
Expressions in template predicate should have no side-effects (that is should not change transformation context).
It's preferred to use function calls or equality comparisons joined by
logical &&
operator for expressions, as it can be better optimized at
compilation time.
var obj = { x: 1 };
console.log(local(obj)({ x: 2 })(obj.x)); // 2
console.log(obj.x); // 1
local
allows you to make temporary changes to a visible variables scope. Every
assignment put inside parens will be reverted immediately after the expression
execution.
You can make multiple assignments in the one statement:
local({ x: 2, y: 3 })(/* your code */)
Or use local
with a block:
local({ ... })(function() { var a = 1; return a * 2; });
Or as an expression:
var newX = local(this)({ x: 2 })(this.x);
template(true)(function() {
return apply({ type: 'first' });
});
template(this.type === 'first')(function() {
return apply({ type: 'second' });
});
template(this.type === 'second')(function() {
return 'here am I';
});
XJST is intended to be applied recursively to the same data, while making small
temporary changes to it (all changes will be reverted back after operation).
apply
keyword works exactly like a local
(applying changes in the parens and
reverting them after the execution), but with small distinction - apply
doesn't have a body, so it's just doing some changes to the data and applying
template recursively (the context will be preserved).
template(this.page === 'home' && this.action === 'login')(function() {
// match here
});
template(this.page === 'home')(function() {
applyNext();
});
applyNext()
call will reapply all templates, except one where it was called,
to the inputs data.
$ bin/xjst --help
Usage:
xjst [OPTIONS] [ARGS]
Options:
-h, --help : Help
-i INPUT, --input=INPUT : Input file (default: stdin)
-o OUTPUT, --output=OUTPUT : Output file (default: stdout)
$ bin/xjst -i template.xjst
.... some code ...
XJST takes all the template
statements and produces a tree with comparisons in
nodes and template
bodies in leafs. apply
are handled and replaced by
direct calls to the tree nodes (some of comparisons can be skipped, using
known context state).
Input:
template(this.type === 'a')(function() {
// body 1
});
template(this.type === 'b')(function() {
// body 2
});
Output (simplified):
switch (this.type) {
case 'a':
// body 1
break;
case 'b':
// body 2
break;
}
Here is the documented source.
Some technical details (in Russian) can be found in doc/tech.ru.md.
FAQs
XSLT inspired JavaScript templates (with spices)
The npm package xjst receives a total of 171 weekly downloads. As such, xjst popularity was classified as not popular.
We found that xjst demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.