
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
jsonify for velocity
基本原理,从一个vm文件a.vm中,依次读取所有变量,生成一个结构化的a.mock.vm,在a.vm 底部,引用a.mock.vm
<!--
#parse('path/to/a.mock.vm')
-->
通过开发的服务器,可以在html注释中得到一些准备好的数据,如下形式
<!--
@@@review
{
"@@!reasonFlag": "{{{false}}}",
"@@!caseId": "{{{4001308230000001}}}",
"@@tbToken.getAjaxUniqueToken()": "{{{5bb5de1e764ee}}}",
"@@!{myserviceModule.setTarget(==json/createMessage.vm==)}": "{{{http://support.daily.taobao.net/myservice/json/create_message.htm}}}"
}@@@
-->
通过执行jear -p xx.html可以得到json结构的数据,这些构成本地demo的模拟数据:
{
"$!reasonFlag": false,
"$!caseId": "4001308230000001",
"$tbToken.getAjaxUniqueToken()": "5bb5de1e764ee",
"$!{myserviceModule.setTarget(\"json/createMessage.vm\")}": "http://support.daily.taobao.net/myservice/json/create_message.htm"
}
这种方案,不考虑vm模板变量运算过程,只关注vm执行过程的输入和输出。
正常情况下,变量读取是从对象查找过程,velocityjs在查找变量之前,首先对比jear提供 的map,如果变量所对应的字符串存在于map中,直接返回结果。
问题解决描述为,我们知道$a.b.c()的结果,在本地模拟过程,我们不需要知道$a对应的变 量,我们最终只需要知道$a.b.c()的结果。开发vm中的所有变量求值过程,可以看做一堆 函数运算,我们知道函数描述和函数的输出,但函数运算过程有无数种可能,这个过程是 无法模拟,但是模拟运算过程,也是为了得到最终的结果。
Install the module with: npm install jear
Usage: jear [option] <file.vm>
Options:
-h, --help output usage information
-V, --version output the version number
-o, --output <filename> out put filename
-p, --parseJSON parse html, get json data
Examples:
$ jear xx.vm
$ jear -p xx.html
$ #pase xx.html to a.json
$ jear -p -o a.json xx.html
Copyright (c) 2013 shepherdwind
Licensed under the MIT license.
FAQs
jsonify for velocity
The npm package jear receives a total of 19 weekly downloads. As such, jear popularity was classified as not popular.
We found that jear demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.