
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
simple-nunjucks-loader
Advanced tools
This Webpack loader compiles Nunjucks templates.
html-webpack-plugin
compatible.
For Webpack 4 support use loader 2.x version
npm install --save-dev simple-nunjucks-loader
If you don't use dynamic assets in your code, then you could
save a bit on optional glob
dependency:
npm install --no-optional --save-dev simple-nunjucks-loader
This loader will precompile Nunjucks templates. It also includes Nunjunks (slim) runtime for browser.
Add loader to your webpack
config as follows:
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.njk$/,
use: [
{
loader: 'simple-nunjucks-loader',
options: {}
}
]
}
]
}
};
template.njk
<p>Hello, {{ username }}!</p>
index.js
import template from './template.njk'
document.body.innerHTML = template({
username: 'Mike'
})
Bundling of index.js
above will render paragraph with text "Hello, Mike!" to
the page.
More examples on loader site.
By default Nunjunks bundle all precompiled templates to
window.nunjucksPrecompiled
, then loads them via custom loader from this
global object. If precompiled template reference some other template file,
it is loaded from disk (in NodeJS environment), or fetched via XMLHttpRequest
from internet and precompile downloaded template in runtime.
Both are not webpack-way for projects bundling.
This loader got template source, parse it with Nunjucks parser, to get AST of template. This AST is iterated to get info on imported templates, used filters and extensions.
Next step is precompile template, to make it faster. Loader injects own wrapper
to avoid default behaviour with creating global window.nunjucksPrecompiled
.
One final step is gather all parts together. Loader is inserts imports of templates, filters and extensions that somehow noted in template, this will make Webpack to rebuild template only when one of essential part is changed.
Then loader expose module that will create separate environment with only required filters and extensions. This module is what you invoke to get your template rendered.
Loader add own {% static %}
tag, for loading assets, and track their change.
Signature is same to static
tag from Django.
template.njk
<img alt="" src="{% static 'image.jpg' %}" />
See more examples of setup and using assets in loader.
When loader found async tags or async filters or extensions in the template,
it calls render
with callback under the hood, and returns Promise
,
instead of render result.
Because of asynchronous nature of Webpack assets loading, all assets, that
loaded via {% static %}
tag, make template to return Promise
too.
Loader supports limited number of Nunjuncks options.
It's doesn't support watch
(we use webpack
own dependencies watch),
noCache
, web
settings and express
.
All other options get passed to Nunjunks Environment
during files loading.
Name | Type | Default | Description |
---|---|---|---|
jinjaCompat | {Boolean} | false | Install Jinja syntax support in bundle |
searchPaths | {String} or {Array.<string>} | . | One or more paths to resolve templates paths |
assetsPaths | {String} or {Array.<string>} | . | Paths to resolve static assets. Works like STATICFILES_DIRS . |
globals | Object.<string, string> | {} | Map global function to corresponding module |
extensions | Object.<string, string> | {} | Map extension to corresponding module |
filters | Object.<string, string> | {} | Map filters to corresponding module |
autoescape | {Boolean} | true | See Nunjuncks options for description of options below |
throwOnUndefined | {Boolean} | false | |
trimBlocks | {Boolean} | false | |
lstripBlocks | {Boolean} | false | |
tags | {Object.<string, string>} | Default Jinja tags config | Override tags syntax |
dev | {Boolean} | true for development and false for production mode | Undocumented Nunjucks option, that will make stacktraces more useful |
tags
default to:
{
blockStart: '{%',
blockEnd: '%}',
variableStart: '{{',
variableEnd: '}}',
commentStart: '{#',
commentEnd: '#}'
}
Installs Jinja syntax. This option install it for whole bundle.
Loader is searching for full template relative to given string(s) from
searchPath
option (or project root, if no paths given).
Path to file couldn't be outside of folders above.
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.njk$/,
use: [{
loader: 'simple-nunjucks-loader',
options: {
searchPaths: [
'django_app_a/templates',
'django_app_b/templates'
]
}
}]
}
]
}
};
List of paths where loader should search for assets.
module.exports = {
module: {
rules: [
{
test: /\.njk$/,
use: [{
loader: 'simple-nunjucks-loader',
options: {
assetsPaths: [
'django_app_a/static',
'django_app_b/static'
]
}
}]
}
]
}
};
Set global function and import path, that should return function to use.
It the same function that env.addGlobal
using.
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.njk$/,
use: [{
loader: 'simple-nunjucks-loader',
options: {
globals: {
_: 'lodash',
globalFn: path.join(__dirname, 'global-fn.js')
}
}
}]
}
]
}
};
global-fn.js
module.exports = function globalFn(foo, bar) {
return `Do anything with ${foo} and ${bar}`;
};
Set map of extensions that would be imported before each template render.
Extension should return instance, that would be added via
env.addExtension
.
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.njk$/,
use: [{
loader: 'simple-nunjucks-loader',
options: {
extensions: {
CustomExtension: path.join(__dirname, 'extension.js')
}
}
}]
}
]
}
};
:boom: Using ES modules syntax for extensions is not yet possible
extension.js
// You should use slim bundle to make it work in browser
const nunjucks = require('nunjucks/browser/nunjucks-slim');
// See example in docs
// https://mozilla.github.io/nunjucks/api.html#custom-tags
class CustomExtension {}
module.exports = new CustomExtension();
Loader trying to guess which extensions are really used, and keep only required imports.
Map of filters, that would be imported before each template render.
Filter should return instance, that would be added via
env.addFilter
.
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.njk$/,
use: [{
loader: 'simple-nunjucks-loader',
options: {
filters: {
filter: path.join(__dirname, 'filter.js')
}
}
}]
}
]
}
};
:boom: Using ES modules syntax for filters is not yet possible
filter.js
module.exports = function filter(val, param) {
return `${val + param}`;
};
template.njk
{{ foo_var | filter(3) }}
Nunjucks is not aware that filter is asynchronous when parse template to AST.
Because of that, you should mark filter as async. To do that, filter module
should export async
flag:
async-filter.js
function asyncFilter(val, param, callback) {
setTimeout(function() {
callback(null, val + param);
}, 1000);
}
asyncFilter.async = true;
module.exports = asyncFilter;
FAQs
Webpack loader for Nunjucks
The npm package simple-nunjucks-loader receives a total of 4,936 weekly downloads. As such, simple-nunjucks-loader popularity was classified as popular.
We found that simple-nunjucks-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.