Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Generating code with AST templates made easy
JavaScript templating is often done through string based template engines.
I wanted to try using AST trees directly instead, it has some advantages:
node my.tpl.js
.Since JavaScript identifiers syntax accepts some Emojis, we can add some extra informations right into them to bring some logic in.
Disclaimer: This module is just an experiment, use it at your own risks.
const asttpl = require('asttpl');
// Here we repeat the property assignation
// for each methods
// The repeat transformation create a context in
// which the object it currently iterates on
// can provide values to subtree of the AST
// see the transformations section for more details
const template = `
module.exports = {
𐅙repeat𐅙methods𐅙name: 𐅙literal𐅙name𐅂upper
};
`;
// Filters may be set to templated values
const filters = {
upper: str => str.toUpperCase()
};
const data = {
methods: [{
name: 'get'
}, {
name: 'put'
}]
};
// Template values are picked into the data
// variable but you can provide several sources
// for templating, this is why the third argument
// is an array
assert.equal(asttpl({ filters }, template, [data])`
module.exports = {
get: 'GET',
put: 'PUT',
};
`);
This is just a simple summary but you should look at the tests to see how it really works.
Pattern: 𐅙variable𐅙${path}
𐅂${filter1}
𐅂${filter2}
𐅂${filterN}
Usage:
Replace a variable name by its matched value after applying it given filters if any. Changing:
let 𐅙variable𐅙myPath𐅂myFilter;
To:
let myShinyNewName;
Pattern: 𐅙literal𐅙${path}
𐅂${filter1}
𐅂${filter2}
𐅂${filterN}
Usage:
Change a variable by a literal with its matched value. Changing:
const myConstant = 𐅙literal𐅙myPath𐅂myFilter;
To:
const myConstant = 'myGeneratedValue';
Pattern: 𐅙repeat𐅙${entriesPath}𐅂${filter1}
𐅂${...filterN}``𐅙${namePath}𐅂
${filter1}𐅂
${...filterN}
Usage:
Repeat functions/variable/properties declarations. Changing:
const myConstant = {
𐅙repeat𐅙myEntriesPath𐅂myFilter𐅙myNamePath𐅂myFilter: 𐅙literal𐅙myRelativePath
};
To:
const myConstant = {
myProp1: 'myRelativeValue1',
myProp2: 'myRelativeValue2',
myProp3: 'myRelativeValue3'
};
Pattern: 𐅙transform𐅙${transformationName}𐅙${path} Usage:
Apply custom transformationName
to the identifier and the path
resolved
values.
Values used for templates are picked with miniquery
. Refer to
its documentation for more details.
The following path characters had to be mapped in order to keep syntactically valid templates:
.
becomes 𐅞
,*
becomes 𐅆
,#
becomes 𐅅
,@
becomes 𐅄
.FAQs
JavaScript AST templating
We found that asttpl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.