Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
grunt-prepr
Advanced tools
Grunt task that provides a C/C++ like preprocessor (with some limitations, see examples) for JavaScript, CSS and other source code. Supported directives are:
#ifdef
#ifndef
#endif
#define
#undef
The task allows to perform both conditional preprocessing of the source code and to define macros.
Install this task next to your project's grunt.js
gruntfile with:
npm install grunt-prepr
Then add the line bellow to your project's grunt.js
gruntfile:
grunt.loadNpmTasks('grunt-prepr');
The standard Grunt conventions are followed when configuring task:
grunt.initConfig({
prepr: {
//Mask, output directory specified
target1: {
defined: ["PROD"],
src: "in/*.js",
dest: "."
},
//Mask, outputting in the same directory
target2: {
defined: ["DEBUG"],
src: "in/*.js"
},
//File mask, JS and CSS, output directory specified
target3: {
defined: ["DEBUG"],
src: "in/*",
dest: "."
},
//Processing single file
target4: {
src: "in/valid_styles_with_variables.css",
dest: "."
},
//Processing recursively all JS files
target5: {
defined: ["DEBUG"],
src: "in/**/*.js",
dest: "."
},
//Preserving blank lines when directives have been processed: using option keepLineBreaks
target6: {
src: "in/*.js",
dest: ".",
keepLineBreaks: true
}
}
});
browserify: {
options: {
transform: [ require('grunt-prepr').browserify(["DEBUG"]) ],
}
}
For more details, refer to the examples in the repository and Jasmine specs.
Although the examples below deal only with JavaScript and CSS, the preprocessor can be used for any source files.
Input:
function add(x, y) {
//#ifdef DEBUG
console.log("add(" + x + ", " + y + ")");
//#endif
return x + y;
}
Task configuration:
grunt.initConfig({
prepr: {
dev: {
defined: ["DEBUG"],
src: "src/*.js",
dest: "build"
},
prod: {
defined: ["PROD"],
src: "src/*.js",
dest: "dist"
}
}
});
Result of running grunt prepr:prod
:
function add(x, y) {
return x + y;
}
Result of running grunt prepr:dev
:
function add(x, y) {
console.log("add(" + x + ", " + y + ")");
return x + y;
}
So in the development version logging to console will be left intact while in the production version it will be removed.
With macros we can, for example, define colors in CSS.
Input:
/* #define $COLOR1 rgb(12, 12, 12)
#define $COLOR2 rgb(23, 45, 67)
#define $DEFAULT_BOX_WIDTH 300px*/
.container {
width: $DEFAULT_BOX_WIDTH;
position: relative;
}
.button {
background-color: $COLOR1;
}
Output:
.container {
width: 300px;
position: relative;
}
.button {
background-color: rgb(12, 12, 12);
}
Macros can also take parameters, please, refer to the Jasmine specs.
A word of caution about using macros. The same concerns as in C/C++ apply, the preprocessor is pretty unaware of the structure of the code (unlike Lisp macros). It treats code as strings and modifications then are pretty limited, the source code with preprocessor directives may become invalid if not handled by a preprocessor and moreover the resulting code may also be invalid if the macros were defined incorrectly.
I would say that #define
should not be used with JavaScript in most of the cases because of these limitations. Just use the normal functions instead. For example,
instead of:
#define MAX(X, Y) (X > Y ? X : Y)
MAX(3, 4);
use pure JavaScript solution:
function max(x, y) {
return x > y ? x : y;
}
max(3, 4);
MIT License (c) Anton Ivanov
The following plugins are used during the build:
The task was inspired by:
FAQs
Grunt preprocessor plugin
The npm package grunt-prepr receives a total of 1 weekly downloads. As such, grunt-prepr popularity was classified as not popular.
We found that grunt-prepr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.