gulp-file-include - npm Package Compare versions

Comparing version 0.7.1 to 0.8.0

index.js

 'use strict';
 
 var concat = require('concat-stream'),
+  merge = require('merge').recursive,
   es = require('event-stream'),
@@ -32,8 +33,4 @@ gutil = require('gulp-util'),
       file.contents.pipe(concat(function(data) {
-        var text = String(data);
-        text = stripCommentedIncludes(text);
-        text = parseConditionalIncludes(text);
-
         try {
-          self.emit('data', include(file, text));
+          self.emit('data', include(file, String(data)));
         } catch (e) {
@@ -45,7 +42,4 @@ self.emit('error', new gutil.PluginError('gulp-file-include', e.message));
       try {
-        var text = String(file.contents);
-        text = stripCommentedIncludes(text);
-        text = parseConditionalIncludes(text);
-
-        self.emit('data', include(file, text));
+        file = include(file, String(file.contents));
+        self.emit('data', file);
       } catch (e) {
@@ -68,3 +62,3 @@ self.emit('error', new gutil.PluginError('gulp-file-include', e.message));
 
-  function parseConditionalIncludes(content) {
+  function parseConditionalIncludes(content, variables) {
     // parse @@if (something) { include('...') }
@@ -75,15 +69,17 @@ var regexp = new RegExp(prefix + 'if.*\\{[^{}]*\\}\\s*'),
 
-    context.content = content;
+    var ctx = merge(true, context);
+    merge(ctx, variables);
+    if (!ctx.content) ctx.content = content;
 
     while (matches) {
       var match = matches[0],
-        includeExps = /\{([^{}]*)\}/.exec(match)[1];
+        includeContent = /\{([^{}]*)\}/.exec(match)[1];
 
       // jshint ignore: start
       var exp = /if(.*)\{/.exec(match)[1];
-      included = new Function('var context = this; return ' + exp + ';').call(context);
+      included = new Function('var context = this; with (context) { return ' + exp + '; }').call(ctx);
       // jshint ignore: end
 
       if (included) {
-        content = content.replace(match, includeExps);
+        content = content.replace(match, includeContent);
       } else {
@@ -100,3 +96,6 @@ content = content.replace(match, '');
   function include(file, text) {
-    var filebase = basepath === "@file" ? path.dirname(file.path) : basepath === "@root" ? process.cwd() : basepath;
+    text = stripCommentedIncludes(text);
+    var variables = {};
+
+    var filebase = basepath === '@file' ? path.dirname(file.path) : basepath === '@root' ? process.cwd() : basepath;
     var matches = includeRegExp.exec(text);
@@ -131,3 +130,3 @@
       var recMatches = includeRegExp.exec(includeContent);
-      if (recMatches && basepath == "@file") {
+      if (recMatches && basepath == '@file') {
         var recFile = new gutil.File({
@@ -148,2 +147,3 @@ cwd: process.cwd(),
         var data = JSON.parse(matches[3]);
+        merge(variables, data);
         // grab keys & sort by longest keys 1st to iterate in that order
@@ -161,2 +161,4 @@ var keys = Object.keys(data).sort().reverse();
 
+    text = parseConditionalIncludes(text, variables);
+
     file.contents = new Buffer(text);
@@ -163,0 +165,0 @@ return file;

package.json

 {
   "name": "gulp-file-include",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "a gulp plugin for file include",
@@ -38,4 +38,5 @@ "main": "index.js",
     "concat-stream": "^1.4.7",
-    "event-stream": "^3.1.7",
-    "gulp-util": "^3.0.1"
+    "event-stream": "^3.2.1",
+    "gulp-util": "^3.0.2",
+    "merge": "^1.2.0"
   },
@@ -42,0 +43,0 @@ "files": [

Readme.md

@@ -150,3 +150,5 @@ [![NPM version][npm-img]][npm-url]
 ```html
-@if (context.name === 'test') {
+@@include('some.html', { "nav": true })
+
+@@if (name === 'test' && nav === true) {
   @@include('test.html')
@@ -153,0 +155,0 @@ }

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

9899

increased by1.62%

Lines of code

147

increased by1.38%

Number of lines in readme file

170

increased by1.19%

Worsened metrics

Dependency count

4

increased by33.33%

Dependency changes

• + Addedmerge@^1.2.0

• + Addedmerge@1.2.1(transitive)

• Updatedevent-stream@^3.2.1

• Updatedgulp-util@^3.0.2