
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Browserify middleware to be able to require() text files (including templates) inside of your client-side JavaScript files.
Browserify plugin to require() text files (such as HTML templates) inside of your client-side JavaScript files.
NOTE: Has not been tested on Node below version 4.0.0, and has been tested up to Node 5.5.0. Please report (or put a Pull Request up for) any bugs you may find.
npm install stringify
browserify -t [ stringify --extensions [.html .hbs] ] myfile.js
var browserify = require('browserify'),
stringify = require('stringify');
var bundle = browserify()
.transform(stringify(['.hjs', '.html', '.whatever']))
.add('my_app_main.js');
app.use(bundle);
You might have noticed that you can pass stringify an optional array of file-extensions that you want to require() in your Browserify packages as strings. By default these are used: .html, .txt, .text, and .tmpl
NOTE: You MUST call this as I have above. The Browserify .transform() method HAS to plug this middleware in to Browserify BEFORE you add the entry point (your main client-side file) for Browserify.
Now, in your clientside files you can use require() as you would for JSON and JavaScript files, but include text files that have just been parsed into a JavaScript string:
var my_text = require('../path/to/my/text/file.txt');
console.log(my_text);
If you require an HTML file and you want to minify the requested string, you can configure Stringify to do it:
stringify({
extensions: ['.txt', '.html'],
minify: true,
minifier: {
extensions: ['.html'],
options: {
// html-minifier options
}
}
})
minifier options are optional.
Default minifier.extensions:
['.html', '.htm', '.tmpl', '.tpl', '.hbs']
Default minifier.options (for more informations or to override those options, please go to html-minifier github):
{
removeComments: true,
removeCommentsFromCDATA: true,
removeCDATASectionsFromCDATA: true,
collapseWhitespace: true,
conservativeCollapse: false,
preserveLineBreaks: false,
collapseBooleanAttributes: false,
removeAttributeQuotes: true,
removeRedundantAttributes: false,
useShortDoctype: false,
removeEmptyAttributes: false,
removeScriptTypeAttributes: false,
removeStyleLinkTypeAttributes: false,
removeOptionalTags: false,
removeIgnored: false,
removeEmptyElements: false,
lint: false,
keepClosingSlash: false,
caseSensitive: false,
minifyJS: false,
minifyCSS: false,
minifyURLs: false
}
To incorporate stringify into a gulp
build process using browserify
,
register stringify
as a transform as follows:
var browserify = require('browserify');
var source = require('vinyl-source-stream');
var stringify = require('stringify');
gulp.task('js', function() {
return browserify({ 'entries': ['src/main.js'], 'debug' : env !== 'dev' })
.transform(stringify({
extensions: ['.html'], minify: true
}))
.bundle()
.pipe(source('main.js')) // gives streaming vinyl file object
.pipe(gulp.dest(paths.build));
});
Allows you to "stringify" your non-JS files using the NodeJS module system. Please only use Stringify this way in NodeJS (Read: Not the browser/Browserify!)
var stringify = require('stringify');
stringify.registerWithRequire({
extensions: ['.txt', '.html'],
minify: true,
minifier: {
extensions: ['.html'],
options: {
// html-minifier options
}
}
});
var myTextFile = require('./path/to/my/text/file.txt');
console.log(myTextFile); // prints the contents of file.
The reason I created this was to get string versions of my Handlebars templates required in to my client-side JavaScript. You can theoretically use this for any templating parser though.
Here is how that is done:
application.js:
var browserify = require('browserify'),
stringify = require('stringify');
var bundle = browserify()
.transform(stringify(['.hbs', '.handlebars']))
.addEntry('my_app_main.js');
app.use(bundle);
my_app_main.js:
var Handlebars = require('handlebars'),
template = require('my/template/path.hbs'),
data = {
"json_data": "This is my string!"
};
var hbs_template = Handlebars.compile(template);
// Now I can use hbs_template like I would anywhere else, passing it data and getting constructed HTML back.
var constructed_template = hbs_template(data);
/*
Now 'constructed_template' is ready to be appended to the DOM in the page!
The result of it should be:
<p>This is my string!</p>
*/
my/template/path.hbs:
<p>{{ json_data }}</p>
If you would like to contribute code, please do the following:
package.json
file.git rebase -i
.npm install && make test
from the source directory.Please do not iterate the package.json version number – I will do that myself when I publish it to NPM.
Please follow this simple style-guide for all code contributions:
function (...) {...}
FAQs
Browserify middleware to be able to require() text files (including templates) inside of your client-side JavaScript files.
We found that stringify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.