On: JMESPath – A query language for JSON

[lioeters]

I love libraries like this, which is small enough to be read in one sitting. I can scan through and get a general understanding of everything that it does.

The "evaluation of sub-expressions" made me curious. This line:

   token.func = Function('_,i,args', 'return ' + token.val);

..could be a potential security issue with user-submitted expressions?

[xonix → lioeters]

Thanks. I doubt this could be a security issue. Typical usage like so

    var name = one(users, '[_.id==?].name', 123)

uses parameterized queries, same idea as with SQL to eliminate injections.

[lioeters → xonix]

I see, I should have dug deeper before commenting. Wow, parameterized queries, there's been a lot of thought put into this compact library!