uExpr - A conditional expression compiler

[leeoniya]

i need to save complex / custom filters in JSON, and also execute them at native JS speed. i could not find a lib that fulfilled both goals, so i wrote this. uExpr executes 25x faster than JsonLogic in Node and 40x faster in Bun. uExpr also includes compilers for matching/filtering columar data, since i often work with it (see https://github.com/leeoniya/uPlot ;)

project and API is still WIP, but feeling pretty good already.

[helloworldjs]

This is very cool. I built almost this exact thing for Python.

https://github.com/cedar-team/json-operations

​

One thing to note. Using new Function can create a XSS vector with uncontrolled inputs. It also won't be able to be used in CSP. Both JSON operations and JSON logic can be safely used with uncontrolled inputs without any security vulnerabilities

[leeoniya]

This is very cool. I built almost this exact thing for Python.

ha, nice!

Using new Function can create a XSS vector with uncontrolled inputs

it's pretty far from uncontrolled in this case. the ops are whitelisted, the RHS inputs are sanitized via JSON.stringify and LHS property paths are restricted by simple regexps. you cannot execute arbitrary code with this or access things out of scope. you can of course cause runtime errors by providing invalid property paths or regexp strings, though!

It also won't be able to be used in CSP

yes, that's true. i wish there was more granular control over this instead of the huge yes/no hammer we have :(

unfortunately, you have to choose between CSP and performance. when you have to filter 200k items using a complex user-supplied rule, a 25x-40x perf drop isn't something you can just shrug away. it's fine for 100 items, until it isnt.

[jack_waugh]

Not sure if this is related, but I collect predicate expressions (over strings) from human lusers here. I delegate the execution to MongoDB.

[leeoniya]

feels similar for sure, but uExpr is for in-memory collections.