punyexpr 🦴

🍁 Overview

A minimalist (5144 bytes) and safe expression compiler and evaluator.

🖥️ Demo

You can experiment with expressions here.

💿 How to install

• npm install punyexpr

• with ESM: import { punyexpor } from 'punyexpr'

• with CommonJS: const { punyexpr } = require('punyexpr')

• Types are included in the package

📚 Documentation

Compile an expression

const incValue = punyexpr('value + 1')

Evaluate the compiled expression

incValue({ value: 1 }) // 2

punyexpr.propertyOf

Hook to change the way a property is obtained from a value.

⚠️ Not used when a value is fetched from the context.

// a does not exist in the context, a.b should fail
punyexpr('a.b')({
  [punyexpr.propertyOf]: (value, property) => {
    // instead, we propagate the undefined value
    if (value === undefined) {
      return undefined
    }
    return value[property]
  }
}) // undefined

Use with punybind@>=1.2.0

const safebind = punybind.use({
  compiler: punyexpr
 })
// Use safebind to bind HTML

📚 Implementation notes

Regular expressions

• Regular expressions are not secure and are not allowed by default,

• Set the option { regex: true } to enable regular expressions using the default JavaScript implementation:

const unsecure = punyexpr('value.match(/a+b/)', { regex: true })

• Or plug any custom regular expression builder:

const unsecure = punyexpr('value.match(/a+b/)', { regex: (pattern, flags) => new RegExp(pattern, flags) })

More details

• Check the source for the implemented grammar,
  in particular the following are not supported :
  • Bitwise, async and coalesce operations
  • new and this
  • Object literals
• See the types definitions for complete API,
• See the tests for supported expressions,
• The implementation is compliant with Content Security Policy.