
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
npm install detachjs
前段时间的工作中,遇到一个需求,大致内容如下:
Q:某应用可见权限功能开发。
A:看了一下待开发的工程,主要发现了以下问题:
1. JSP + JS和CSS内外联、内嵌
2. 前端修改了jsp的布局样式需要重新部署到服务器,才能看到效果,不利于开发过程中的调试,失去了前端所见即所得的优势
3. JSP页面嵌入了大量的EL表达式和JSP标签不便于前端理解,这样前后端分工不明确,以致于工作效率较低
基于以上分析:
1. 如果我们采用(前后端完全分离)JSP改为html,采用restful架构通过JSON交换数据,js渲染视图层(复杂度高,成本高,不推荐)。
2. 如果我们采用(前后端半分离)JSP页面解耦为DOM框架,通过js动态加载html模板,EL表达式和JSP标签问题可采用html模板引擎对接(复杂度中低,成本中低,具体根据业务场景决定是否分离以及分离程度,寻找平衡,权衡利弊)
综上所述,提出了本文中前后端半分离的这种思想。
工程重构过程
<ul>
...
<li>
<a href="#app_tab">应用信息</a>
</li>
...
</ul>
<div>
<table>
<!--jsp页面html和jsp标签以及EL表达式混合内容,部分可能含有java片段-->
...
</table>
</div>
<ul>
...
<li>
<a href="#app_tab">应用信息</a>
</li>
<!--新增加功能开始-->
<li>
<a href="#app_permission">可见权限配置</a>
</li>
<!--新增加功能结束 -->
...
</ul>
<div>
<table>
//jsp页面html和jsp标签以及EL表达式混合内容,部分可能含有java片段
...
</table>
</div>
<!--新增加功能-->
<div></div>

把界面的布局放到app_permission.html模板中,然后异步加载html模板到web容器中,即可

经过改造,模板通过ajax加载,然后我们可以用fiddler做本地替换,达到开发过程中所见即所得的效果。
(图1——浏览器http请求图)

(图2——fiddler http请求抓取)

半分离改造后的优势
半分离改造灵感来源于SPA应用框架Angularjs (具有可行性,有理论和实践作支撑)
按需加载
减轻后台服务器压力
页面结构清晰,而且方便页面实现组件化
开发过程中,修改或增加页面无需重新部署
利于单元测试
注:由于js加载页面,会导致搜索引擎蜘蛛程序搜不到模板,对SEO有要求的网站应用要适当的采取此方法进行分离
首先引入
<script src="detach.min.js"></script>
然后直接调用
Detach.init({
...
});
| methods | describe | options |
|---|---|---|
init | Init template | {name: 'XXX', /* required */ container: document.querySelector('.parent'), /* default: document.body */data: {name: 'reamd',age: 18}, /* default: {} */tpl: './template/tpl.html', /* required */controller: function(){}, /* default: function(){} */onReady: function(){} /* default: function(){} */} |
destroy | Destroy template from dom | {name: 'XXX'} |
router.push | According to the name show template | {name: 'XXX'} |
route.delete | According to the name hide template | {name: 'XXX'} |
sub | subscribe messaging bus | ['string', function] |
pub | publish messaging bus | ['name', object] |
tpl.html中引入的外链css和js以tpl.html所在目录为参考目录,进行相对路径的引用。
FAQs
web项目半分离改造组件
We found that detachjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.