
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
A flexible JSONPath engine for Python.
We follow RFC 9535 and test against the JSONPath Compliance Test Suite.
Table of Contents
Install Python JSONPath using pip:
pip install python-jsonpath
Or Pipenv:
pipenv install -u python-jsonpath
Or from conda-forge:
conda install -c conda-forge python-jsonpath
JSONPath RFC 9535 - A Python implementation of JSONPath that follows RFC 9535 much more strictly. If you require maximum interoperability with JSONPath implemented in other languages - at the expense of extra features - choose jsonpath-rfc9535 over python-jsonpath.
jsonpath-rfc9535 matches RFC 9535's JSONPath model internally and is careful to use the spec's terminology. It also includes utilities for verifying and testing the JSONPath Compliance Test Suite. Most notably the nondeterministic behavior of some JSONPath selectors.
JSON P3 - RFC 9535 implemented in TypeScript. JSON P3 does not include all the non-standard features of Python JSONPath, but does define some optional extra syntax.
Ruby JSON P3 - RFC 9535, RFC 6901 and RFC 6902 implemented in Ruby.
import jsonpath
data = {
"users": [
{"name": "Sue", "score": 100},
{"name": "John", "score": 86},
{"name": "Sally", "score": 84},
{"name": "Jane", "score": 55},
]
}
user_names = jsonpath.findall("$.users[?@.score < 100].name", data)
print(user_names) # ['John', 'Sally', 'Jane']
We include an RFC 6901 compliant implementation of JSON Pointer. See JSON Pointer quick start, guide and API reference
from jsonpath import pointer
data = {
"users": [
{"name": "Sue", "score": 100},
{"name": "John", "score": 86},
{"name": "Sally", "score": 84},
{"name": "Jane", "score": 55},
]
}
sue_score = pointer.resolve("/users/0/score", data)
print(sue_score) # 100
jane_score = pointer.resolve(["users", 3, "score"], data)
print(jane_score) # 55
We also include an RFC 6902 compliant implementation of JSON Patch. See JSON Patch quick start and API reference
from jsonpath import patch
patch_operations = [
{"op": "add", "path": "/some/foo", "value": {"foo": {}}},
{"op": "add", "path": "/some/foo", "value": {"bar": []}},
{"op": "copy", "from": "/some/other", "path": "/some/foo/else"},
{"op": "add", "path": "/some/foo/bar/-", "value": 1},
]
data = {"some": {"other": "thing"}}
patch.apply(patch_operations, data)
print(data) # {'some': {'other': 'thing', 'foo': {'bar': [1], 'else': 'thing'}}}
python-jsonpath
is distributed under the terms of the MIT license.
FAQs
JSONPath, JSON Pointer and JSON Patch for Python.
We found that python-jsonpath demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.