Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This tool can be used to generate the JSON schema from a Swagger version 2 or 3 (OpenAPI) or AsyncAPI 2 YAML file.
Node.js version 7.0 (in theory) or newer. Tested with 8.12.0, 10.13.0, 10.14.1, 13.11.0, and 14.15.1
npm version 6.1.0 or newer. Tested with 6.1.0, 6.4.1, 6.14.7, 6.14.8, 6.14.10, and 7.21.0
If you want the tool to be available globally:
npm install ytoj -g
or install it locally in your project:
npm install ytoj --save-dev
The first time you run the tool:
ytoj
or (if not installed globally)
npx ytoj
the tool will run interactively collecting some information:
Generate JSON schema from Swagger, OpenAPI, or AsyncAPI YAML document.
Version 4.0.4
Swagger YAML file: sample/petstore-simple.yaml
Output JSON schema: schema/petstore-simple.json
$schema: (http://json-schema.org/draft-07/schema#)
$id: () http://my.schema.com
Resolve $refs? (n) n
Allow additionalProperties? (n) n
Indent size in the output JSON file (2): 3
Input: sample/petstore-simple.yaml
Output: schema/petstore-simple.json
$schema: http://json-schema.org/draft-07/schema#
$id: http://my.schema.com
Resolve $refs: false
additionalProperties: false
Indent size: 3
Does everything look good (y)? y
Save these settings in ytoj.json (y)? y
If you answer yes to the last question this information will be saved in the configuration file called ytoj.json, so the next time the tool is run it can read it from there and will not ask for it again. This way you can incorporate it in a build process.
If you want to go back to the interactive mode, just delete ytoj.json
$ref
s in the schema. Defaults to "no".additionalProperties
in JSON instances. Defaults to "no".The tool can also be run by specifying all parameters on the command line instead of interactively or from the configuration file. Run
ytoj --help
or (if not installed globally)
npx ytoj --help
To see all avaialble parameters:
-i, --input <file path> YAML input file (required)
-o, --output <file path> JSON schema output file (required)
-s, --schema <url> $schema (default http://json-schema.org/draft-07/schema#)
-d, --id <url> $id
-r, --resolve-refs resolve $refs in the schema
-a, --additional-properties allow additionalProperties in the schema
-t, --indent <number> indent size in the output JSON file (default 2)
-c, --config <file path> use settings from this file
--save-settings save parameters to the configuration file and exit
-h, --help display help for command
Note that the -c, --config
parameter can be used three ways:
--save-settings
parameter, all parameters given on the command line will be saved in this configuration file, and the tool will exit.The functionality is also available as an API. To use it, import
or require
this package,
and then just call the ytoj
function. Here is an example:
const { ytoj } = require('ytoj');
async function convertSwagger(input) {
try {
const schema = await ytoj(input, { id: 'http://example.com/my-swagger', resolveRefs: true });
console.log(JSON.stringify(schema, null, 2));
} catch (e) {
console.log(e.message);
}
}
const schemaObj = await ytoj(yamlString, options);
yamlString
A
String
that contains some Swagger/OpenAPI/AsyncAPI YAML specification.
options
An optional
Object
that may supply configuration parameters (all optional):
schema
- The URI defining the (meta-)schema for the generated JSON schema. Defaults to draft-07 of JSON schema: 'http://json-schema.org/draft-07/schema#'
.id
- The URI defining the instance of the generated schema. If specified, it is expected to be something that identifies your application/project/organization.resolveRefs
- Specifies whether to resolve $ref
s in the schema. Defaults to false
.additionalProperties
- Specifies whether the genereated schema allows additionalProperties
in JSON instances. Defaults to false
.The function returns a Promise<Object>
, where the Object
represents the JSON schema corresponding to the input Swagger/OpenAPI specification.
Note that the function is async
, and so it must be called with await
within a try
block or with .then().catch()
. It throws
in case of invalid input or options.
FAQs
Generates JSON schema from Swagger/Open API YAML specifications
The npm package ytoj receives a total of 220 weekly downloads. As such, ytoj popularity was classified as not popular.
We found that ytoj demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.