Installations
npm install JSONPath
Developer Guide
Typescript
No
Module System
CommonJS
Node Version
4.1.2
NPM Version
3.3.9
Score
95.7
Supply Chain
99.5
Quality
79.4
Maintenance
100
Vulnerability
100
License
Releases
Contributors
Unable to fetch Contributors
Languages
JavaScript (98.66%)
HTML (1.34%)
Developer
s3u
Download Statistics
Total Downloads
7,705,018
Last Day
1,025
Last Week
14,275
Last Month
121,430
Last Year
1,049,777
GitHub Statistics
996 Stars
452 Commits
177 Forks
21 Watching
2 Branches
33 Contributors
Bundle Size
8.10 kB
Minified
2.88 kB
Minified + Gzipped
Package Meta Information
Latest Version
0.11.2
Package Id
JSONPath@0.11.2
Size
11.18 kB
NPM Version
3.3.9
Node Version
4.1.2
Total Downloads
Cumulative downloads
Total Downloads
7,705,018
Last day
-75.9%
1,025
Compared to previous day
Last week
-36.4%
14,275
Compared to previous week
Last month
38.4%
121,430
Compared to previous month
Last year
33.1%
1,049,777
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dev Dependencies
1
JSONPath
(This package is being moved to "jsonpath-plus" to avoid npm problems in dealing with upper-case packages.)
Analyse, transform, and selectively extract data from JSON documents (and JavaScript objects).
Install
npm install JSONPath
Usage
Syntax
In node.js:
1var JSONPath = require('JSONPath');
2JSONPath({json: obj, path: path, callback: callback});
For browser usage you can directly include lib/jsonpath.js
, no browserify
magic necessary:
1<script src="lib/jsonpath.js"></script>
2<script>
3 JSONPath({path: path, json: obj, callback: callback, otherTypeCallback: otherTypeCallback});
4</script>
An alternative syntax is available as:
1JSONPath(options, path, obj, callback, otherTypeCallback);
The following format is now deprecated:
1jsonPath.eval(options, obj, path);
Properties
The properties that can be supplied on the options object or evaluate method (as the first argument) include:
- path (required) - The JSONPath expression as a (normalized or unnormalized) string or array
- json (required) - The JSON object to evaluate (whether of null, boolean, number, string, object, or array type).
- autostart (default: true) - If this is supplied as
false
, one may call theevaluate
method manually. - flatten (default: false) - Whether the returned array of results will be flattened to a single dimension array.
- resultType (default: "value") - Can be case-insensitive form of "value", "path", "parent", or "parentProperty" to determine respectively whether to return results as the values of the found items, as their absolute paths, as their parent objects, or as their parent's property name. If set to "all", all of these types will be returned on an object with the type as key name.
- sandbox (default: {}) - Key-value map of variables to be available to code evaluations such as filtering expressions. (Note that the current path and value will also be available to those expressions; see the Syntax section for details.)
- wrap (default: true) - Whether or not to wrap the results in an array. If
wrap
is set to false, and no results are found,undefined
will be returned (as opposed to an empty array withwrap
set to true). Ifwrap
is set to false and a single result is found, that result will be the only item returned (not within an array). An array will still be returned if multiple results are found, however. - preventEval (default: false) - Although JavaScript evaluation expressions are allowed by default, for security reasons (if one is operating on untrusted user input, for example), one may wish to set this option to
true
to throw exceptions when these expressions are attempted. - parent (default: null) - In the event that a query could be made to return the root node, this allows the parent of that root node to be returned within results.
- parentProperty (default: null) - In the event that a query could be made to return the root node, this allows the parentProperty of that root node to be returned within results.
- callback (default: (none)) - If supplied, a callback will be called immediately upon retrieval of an end point value. The three arguments supplied will be the value of the payload (according to
resultType
), the type of the payload (whether it is a normal "value" or a "property" name), and a full payload object (with allresultType
s). - otherTypeCallback (default: <A function that throws an error when @other() is encountered>) - In the current absence of JSON Schema support, one can determine types beyond the built-in types by adding the operator
@other()
at the end of one's query. If such a path is encountered, theotherTypeCallback
will be invoked with the value of the item, its path, its parent, and its parent's property name, and it should return a boolean indicating whether the supplied value belongs to the "other" type or not (or it may handle transformations and return false).
Instance methods
- evaluate(path, json, callback, otherTypeCallback) OR evaluate({path: <path>, json: <json object>, callback: <callback function>, otherTypeCallback: <otherTypeCallback function>}) - This method is only necessary if the
autostart
property is set tofalse
. It can be used for repeated evaluations using the same configuration. Besides the listed properties, the latter method pattern can accept any of the other allowed instance properties (except forautostart
which would have no relevance here).
Class properties and methods
- JSONPath.cache - Exposes the cache object for those who wish to preserve and reuse it for optimization purposes.
- JSONPath.toPathArray(pathAsString) - Accepts a normalized or unnormalized path as string and converts to an array: for example,
['$', 'aProperty', 'anotherProperty']
. - JSONPath.toPathString(pathAsArray) - Accepts a path array and converts to a normalized path string. The string will be in form like:
$['aProperty']['anotherProperty]
. The terminal constructions~
and typed operators like@string()
, as with$
, get added without enclosing single quotes and brackets.
Syntax through examples
Given the following JSON, taken from http://goessner.net/articles/JsonPath/ :
1{ 2 "store": { 3 "book": [ 4 { 5 "category": "reference", 6 "author": "Nigel Rees", 7 "title": "Sayings of the Century", 8 "price": 8.95 9 }, 10 { 11 "category": "fiction", 12 "author": "Evelyn Waugh", 13 "title": "Sword of Honour", 14 "price": 12.99 15 }, 16 { 17 "category": "fiction", 18 "author": "Herman Melville", 19 "title": "Moby Dick", 20 "isbn": "0-553-21311-3", 21 "price": 8.99 22 }, 23 { 24 "category": "fiction", 25 "author": "J. R. R. Tolkien", 26 "title": "The Lord of the Rings", 27 "isbn": "0-395-19395-8", 28 "price": 22.99 29 } 30 ], 31 "bicycle": { 32 "color": "red", 33 "price": 19.95 34 } 35 } 36}
and the following XML representation:
1<store> 2 <book> 3 <category>reference</category> 4 <author>Nigel Rees</author> 5 <title>Sayings of the Century</title> 6 <price>8.95</price> 7 </book> 8 <book> 9 <category>fiction</category> 10 <author>Evelyn Waugh</author> 11 <title>Sword of Honour</title> 12 <price>12.99</price> 13 </book> 14 <book> 15 <category>fiction</category> 16 <author>Herman Melville</author> 17 <title>Moby Dick</title> 18 <isbn>0-553-21311-3</isbn> 19 <price>8.99</price> 20 </book> 21 <book> 22 <category>fiction</category> 23 <author>J. R. R. Tolkien</author> 24 <title>The Lord of the Rings</title> 25 <isbn>0-395-19395-8</isbn> 26 <price>22.99</price> 27 </book> 28 <bicycle> 29 <color>red</color> 30 <price>19.95</price> 31 </bicycle> 32</store>
Please note that the XPath examples below do not distinguish between retrieving elements and their text content (except where useful for comparisons or to prevent ambiguity).
XPath | JSONPath | Result | Notes |
---|---|---|---|
/store/book/author | $.store.book[*].author | The authors of all books in the store | |
//author | $..author | All authors | |
/store/* | $.store.* | All things in store, which are its books (a book array) and a red bicycle (a bicycle object). | |
/store//price | $.store..price | The price of everything in the store. | |
//book[3] | $..book[2] | The third book (book object) | |
//book[last()] | $..book[(@.length-1)] $..book[-1:] | The last book in order. | |
//book[position()<3] | $..book[0,1] $..book[:2] | The first two books | |
//book/*[self::category|self::author] or //book/(category,author) in XPath 2.0 | $..book[0][category,author] | The categories and authors of all books | |
//book[isbn] | $..book[?(@.isbn)] | Filter all books with an ISBN number | |
//book[price<10] | $..book[?(@.price<10)] | Filter all books cheaper than 10 | |
//*[name() = 'price' and . != 8.95] | $..*[?(@property === 'price' && @ !== 8.95)] | Obtain all property values of objects whose property is price and which does not equal 8.95 | |
/ | $ | The root of the JSON object (i.e., the whole object itself) | |
//*/*|//*/*/text() | $..* | All Elements (and text) beneath root in an XML document. All members of a JSON structure beneath the root. | |
//* | $.. | All Elements in an XML document. All parent components of a JSON structure including root. | This behavior was not directly specified in the original spec |
//*[price>19]/.. | $..[?(@.price>19)]^ | Parent of those specific items with a price greater than 19 (i.e., the store value as the parent of the bicycle and the book array as parent of an individual book) | Parent (caret) not documented in the original spec |
/store/*/name() (in XPath 2.0) | $.store.*~ | The property names of the store sub-object ("book" and "bicycle"). Useful with wildcard properties. | Property name (tilde) is not present in the original spec |
/store/book[not(. is /store/book[1])] (in XPath 2.0) | $.store.book[?(@path !== "$['store']['book'][0]")] | All books besides that at the path pointing to the first | @path not present in the original spec |
//book[parent::*/bicycle/color = "red"]/category | $..book[?(@parent.bicycle && @parent.bicycle.color === "red")].category | Grabs all categories of books where the parent object of the book has a bicycle child whose color is red (i.e., all the books) | @parent is not present in the original spec |
//book/*[name() != 'category'] | $..book.*[?(@property !== "category")] | Grabs all children of "book" except for "category" ones | @property is not present in the original spec |
//book/*[position() != 0] | $..book[?(@property !== 0)] | Grabs all books whose property (which, being that we are reaching inside an array, is the numeric index) is not 0 | @property is not present in the original spec |
/store/*/*[name(parent::*) != 'book'] | $.store.*[?(@parentProperty !== "book")] | Grabs the grandchildren of store whose parent property is not book (i.e., bicycle's children, "color" and "price") | @parentProperty is not present in the original spec |
//book[count(preceding-sibling::*) != 0]/*/text() | $..book.*[?(@parentProperty !== 0)] | Get the property values of all book instances whereby the parent property of these values (i.e., the array index holding the book item parent object) is not 0 | @parentProperty is not present in the original spec |
//book/../*[. instance of element(*, xs:decimal)] (in XPath 2.0) | $..book..*@number() | Get the numeric values within the book array | @number(), the other basic types (@boolean(), @string()), other low-level derived types (@null(), @object(), @array()), the JSONSchema-added type, @integer(), the type, @other(), to be used in conjunction with a user-defined callback (see otherTypeCallback ) and the following non-JSON types that can nevertheless be used with JSONPath when querying non-JSON JavaScript objects (@undefined(), @function(), @nonFinite()) are not present in the original spec |
Any additional variables supplied as properties on the optional "sandbox" object option are also available to (parenthetical-based) evaluations.
Potential sources of confusion for XPath users
- In JSONPath, a filter expression, in addition to its
@
being a reference to its children, actually selects the immediate children as well, whereas in XPath, filter conditions do not select the children but delimit which of its parent nodes will be obtained in the result. - In JSONPath, array indexes are, as in JavaScript, 0-based (they begin from 0), whereas in XPath, they are 1-based.
- In JSONPath, equality tests utilize (as per JavaScript) multiple equal signs whereas in XPath, they use a single equal sign.
Todos
- Conditionally resolve JSON references/JSON pointers instead or in addition to raw retrieved data, with options on how deeply nested.
- Support non-eval version (which supports parenthetical evaluations)
- Support OR outside of filters (as in XPath
|
). - Create syntax to work like XPath filters in not selecting children?
- Allow for type-based searches to be JSON Schema aware (and allow retrieval of schema segment for a given JSON fragment)
- Pull or streaming parser?
- Allow option for parentNode equivalent (maintaining entire chain of parent-and-parentProperty objects up to root)
- Fix in JSONPath to avoid need for
$
? - Define any allowed behaviors for:
$.
,$[0]
,$.[0]
, or$.['prop']
- Modularize operator detection and usage to allow for extensibility (at least non-standard ones)?
Development
Running the tests on node: npm test
. For in-browser tests:
- Ensure that nodeunit is browser-compiled:
cd node_modules/nodeunit; make browser;
- Serve the js/html files:
1 node -e "require('http').createServer(function(req,res) { \ 2 var s = require('fs').createReadStream('.' + req.url); \ 3 s.pipe(res); s.on('error', function() {}); }).listen(8082);"
- To run the tests visit http://localhost:8082/test/test.html.
License
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
23 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Warn: project license file does not contain an FSF or OSI license.
Reason
Found 5/25 approved changesets -- score normalized to 2
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/node.js.yml:1
- Info: no jobLevel write permissions found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'main'
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/JSONPath-Plus/JSONPath/node.js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/JSONPath-Plus/JSONPath/node.js.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/node.js.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/JSONPath-Plus/JSONPath/node.js.yml/main?enable=pin
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 10 are checked with a SAST tool
Score
5.2
/10
Last Scanned on 2024-12-16
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More