
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
gulp-rev-hash3
Advanced tools
Appends a file's hash to a file URL to cache assets in any file (html, templates)
=============
正则匹配出html文件中的css和js路径,根据其文件内容计算出hash值作为版本号.如:
<!-- rev-hash -->
<link rel="stylesheet" href="main.min.css?v=9d58b7441d92130f545778e418d1317d">
<!-- end -->
由于项目打包需求,在已有npm gulp-rev-hash 组件基础上进行了扩展和优化! Fork 至 https://github.com/outluch/gulp-rev-hash.git
npm install gulp-rev-hash3
原理:正则匹配出html文件中的css和js路径,根据其文件内容计算出hash值作为版本号;
具体实现思路:
意义:根据静态文件内容来计算其hash,只有在内容改变时,其hash值才会改变,这样,在缓存有效期内,客户端不会再次下载该静态资源,也减轻服务端压力,同时加快渲染提升了用户体验。
默认情况下,打包时,node以gulpfile所在目录为当前目录,然后根据script及link标签中的路径来读取文件,如果script及link设置的路径与gulpfile不在同一目录,则需要配置assetsDir,即静态资源所在目录,读取文件时,会以assetsDir+ js/css path作为路径来读取。
var gulp = require('gulp');
var revHash = require('gulp-rev-hash3');
gulp.task('rev-hash', function () {
return gulp.src('test/*.html')
.pipe(revHash({
assetsDir: 'test',
}))
.pipe(gulp.dest('test'));
});
<!-- rev-hash -->
<link rel="stylesheet" href="main.min.css">
<!-- end -->
<!-- rev-hash -->
<script src="abc.js"></script>
<script src="def.js"></script>
<!-- end -->
<!-- rev-hash -->
<link rel="stylesheet" href="main.min.css?v=9d58b7441d92130f545778e418d1317d">
<!-- end -->
<!-- rev-hash -->
<script src="abc.js?v=0401f2bda539bac50b0378d799c2b64e"></script>
<script src="def.js?v=e478ca95198c5a901c52f7a0f91a5d00"></script>
<!-- end -->
在demo项目中,以gulp-rev-hash3为项目目录,以gulpfile为基准,则项目的目录为"./",假设需要配置域名cdn.xxxx.com 对应 test目录,则对应的域名配置为
{
domain:"cdn.xxxx.com",
path:"test"
}
在读取静态资源时,node会以 projectPath + domain path + js/css path 作为路径来读取,此时不受assetsDir的影响;
其打包配置为:
var gulp = require('gulp');
var rev = require('./index');
gulp.task('test', function() {
return gulp.src('test/*.html')
.pipe(rev({
assetsDir: 'test',
remotePath:[{
domain:"cdn.xxxx.com",
path:"test"
}],
projectPath:"./"
}))
.pipe(gulp.dest('test'));
});
<!-- rev-hash -->
<link rel="stylesheet" href="main.min2.css"/>
<link rel="stylesheet" href="//cdn.xxxx.com/main.min2.css"/>
<!-- end -->
<!-- rev-hash -->
<script src="abc.js"></script>
<script src="//cdn.xxxx.com/def.js"></script>
<!-- end -->
<!-- rev-hash -->
<link rel="stylesheet" href="main.min2.css?v=aa4488642be0a613ad4e840e9617ee48"/>
<link rel="stylesheet" href="//cdn.xxxx.com/main.min2.css?v=aa4488642be0a613ad4e840e9617ee48"/>
<!-- end -->
<!-- rev-hash -->
<script src="abc.js?v=9c811ea8215aeaac0efff4fae71a9022"></script>
<script src="//cdn.xxxx.com/def.js?v=e5803321a29f976103521afa380a5b52"></script>
<!-- end -->
示例:
assetsDir: 'test',
remotePath:[{
domain:"cdn.xxxx.com",
path:"test"
}],
projectPath:"./"
说明:
参数 | 说明 | 默认值 |
---|---|---|
assetsDir | 静态资源文件目录现对于gulpfile的路径,即以gulpfile所在目录 为起点,assetsDir+script.src能找到对应的js; | "" |
remotePath | 域名对应文件目录 | 无 |
projectPath | 相对于gulpfile,项目目录地址,或者理解为配置domain path时,path所在目录,即以gulpfile所在目录 为起点,projectPath + domain path +script.src能找到对应的js | ../,gulpfile上一级 |
- 对于html中通过相对路径引用(
./
或者../
)的静态资源,插件会根据html的路径找到具体的静态资源文件。- 对于通过
/
方式引用的静态资源<script src="/def.js">
,组件会根据assetsDir+script.src 的方式去寻找具体的静态资源文件- 对于通过cdn应用的静态资源,组件会通过
projectPath + domain path +script.src
的方式去寻找具体的静态资源文件
由于计算hash值需要能读取让node读取到其二进制文件,需保证以当前gulpfile所在目录为起点能访问到需要加版本号的静态资源文件(css,js);
去掉冗余兼容
初次发布版本
FAQs
Appends a file's hash to a file URL to cache assets in any file (html, templates)
The npm package gulp-rev-hash3 receives a total of 3 weekly downloads. As such, gulp-rev-hash3 popularity was classified as not popular.
We found that gulp-rev-hash3 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.