esprima VS estree

I'm particularly fond of Firecracker, but it’s a bit of work to set up, so if you cannot afford the time yet, you want to be on the safe side, do a combination of static analysis and time-boxing execution. You can use esprima to parse the code and check for any malicious act.

Focusing again on ESLint, the parser used by the linter is called Espree. This is an in-house parser built by the ESLint folks to fully support ECMAScript 6 and JSX on top of the already existing Esprima. The Espree module provide APIs for both tokenization and parsing that you can easily test out.

For TypeScript we have used AST transforms from their compiler API, and for plain JavaScript we did a similar thing using ESPrima. This helped us implement some simple optimizations like stream fusion (combining .filter and .map into a single operation) or avoiding extra object allocations in vector math, which led to nice performance improvements in code that does heavy computation (we process large amounts of data on the server and store results of physics simulations).

I used ESPrima, but any parser would do in this case. I then wrote a simple function to extract all "atomic" non-boolean expressions from it.

AST is an acronym for Abstract Syntax Tree. It's the way to represent code in a format that tools can understand. Usually in form of tree data structure. We will use AST in the format of an Esprima, which is a JavaScript parser that outputs AST.

esprima

Create an AST: Esprima

The thread was originally about CRA vs Vite size on disk (or implicitly, if we're applying it to real world applications, network cost in CI job startup times). And like I said, surrogate pairs don't apply to ASCII.

See this[0] for reference. Note how the first byte must fall within a certain range in order to signal being a surrogate pair. This fact is taken advantage of by JS parsers to make parsing of ASCII code faster by special casing that range, since checking for a valid character in the entire unicode range is quite a bit more expensive[1].

[0] https://github.com/jquery/esprima/blob/0911ad869928fd218371b...

[1] https://github.com/jquery/esprima/blob/0911ad869928fd218371b...

If you want to learn more about parsing, reading the code of an actual recursive parser might be a better idea. Esprima is a decent place to start if you're interested in JS grammar. Then you can look at the babel handbook to learn more about AST transformations. From there, the literature gets quite a bit more heavy. If you get this far and are willing to push further, you'll probably want to grab yourself a copy of the dragon book at a minimum.

ESLint's AST format, ESTree, would represent this line of code as:

That was a super interesting link, thank you.

For the ontological problem, I presume you're referring to how there are so many differing ideas of how to represent ASTs (apologies for mixing languages, these URLs were just handy):

* https://lisperator.net/uglifyjs/ast#nodes

* https://github.com/estree/estree#the-estree-spec

* ... likely others

which makes it hard for ls1 to ask ls2 about "the for-of iteration variable Node" because ls2 could be using UglifyJS or ESTree or their own(!) AST nomenclature?

And all of this is made worse by (e.g.) Java1.3 versus Java19 because languages are rarely static

I find it better to actually look at the AST for javascript.

These are expressions:

https://github.com/estree/estree/blob/master/es5.md#expressi...

These are statements:

https://github.com/estree/estree/blob/master/es5.md#statemen...

I guess the confusing part for many is how an expression can also be a statement. But if you look at the ExpressionStatement you see that an expression is not also a statement. It's just the wrapper statement!

When I started the NodeSecure project I had almost no experience 🐤 with AST (Abstract Syntax Tree). My first time was on the SlimIO project to generate codes dynamically with the astring package (and I had also looked at the ESTree specification).

ESTree compatible output, AST explorer on WASM

The parser we wrote transforms the GraphQL AST into ESTree structure, so it allows you to travel the GraphQL AST tree easily.

For espree parser(the one eslint uses) we can refer here Eslint AST Node Types