
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Have your arguments, and validate it too. -- Slick arguments validator for all your js functions.
Have your arguments, and validate it too:
var have = require('have');
function safeFunc(id, options, callback) {
have(arguments,
{ id : 'string or number'
, options : 'optional object'
, callback : 'function'
});
}
HAVE.js gives you a mini-DSL to quickly validate your function arguments.
In order of precedence:
opt X|optional X - Optional XX or Y - Either X or YX a|X arr|x array - Array of Xs|str|string - Stringn|num|number - Numberb|bool|boolean - Booleanf|fun|func|function - Functiona|arr|array - Arrayo|obj|object - Objectr|rx|regex|regexp - RegExpd|date - DateThese matchers can be combined. These are all valid HAVE.js matchers:
str or num array - String or Array of Numbernum arr or str arr - Array of Number or Array of Stringnum a a a a - Array of Array of Array of Array of Numberopt str or num array - Optional (String or Array of Number)Have fun!
The HAVE.js function also returns any parsed argument collected in a hash keyed to the same key as was given in the schema. You can inspect the returned object to more easily obtain the parsed value without having to duplicate the HAVE.js parsing logic in your code to extract them.
var have = require('have');
function safeFunc(id, options, callback) {
var args = have(arguments,
{ id : 'string or number'
, options : 'optional object'
, callback : 'function'
});
options = args.options || { some: 'value' };
// some stuff
someDb.loadById(args.id, options, args.callback);
};
For a more careful argument names parsing you can pass several schema.
var have = require('have');
function safeFunc() {
var args = have(arguments,
[ { id : 'string or number'
, options : 'optional object'
, callback : 'function'
}
, { query : 'object'
, options : 'optional object'
, callback : 'function'
}
]);
var options = args.options || { some: 'value' };
// some stuff
if (args.id) {
someDb.loadById(args.id, options, args.callback);
} else {
someDb.find(args.query, options, args.callback);
}
};
And use "strict" mode to fail for those extra arguments that do not match the schema.
var have = require('have');
function safeFunc(id, options, callback) {
var args = have.strict(arguments,
{ id : 'string or number'
, options : 'optional object'
, callback : 'function'
});
// some stuff
};
// This throws an AssertionError: Wrong argument "foo"
safeFunc('id', { key: 'value' }, cb, 'foo')
If you are like me and you write a lot of method preconditions that should be turned off or atleast, should not throws in production, you can replace HAVE.js assert function like so:
var have = require('have');
have.assert(function(cond, message) {
if (!cond) {
console.log('WARN: assertion failed: ' + message);
}
});
This will replace the assert function HAVE.js uses internally with your implementation
so if you want to completely turns assertion off, then just give it a no-op function.
For those who like it short, the above example can also be written like this:
var have = require('have');
function safeFunc(id, options, callback) {
have(arguments, { id: 's or n', options: 'opt o', callback: 'f' });
}
This is not very readable, of course. But HAVE.js does not dictate your readability preference for you. So go wild if you think it is ok : )
BSD (if you don't like BSD, just contact me)
boolean support.null and undefined where optional argument is expected.Test with npm test or make test.
Just open a new GitHub issue or ping me @chakrit on Twitter.
Pull requests and feature suggestions totally welcome.
40 Chakrit Wichian
2 Makeev Vitaliy
1 Edmond Meinfelder
FAQs
Have your arguments, and validate it too. -- Slick arguments validator for all your js functions.
The npm package have receives a total of 226 weekly downloads. As such, have popularity was classified as not popular.
We found that have demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.