Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
vite-plugin-handlebars
Advanced tools
vite-plugin-handlebars
Vite support for Handlebars
I really like Vite as a simple static site bundler. It can handle bundling multiple HTML files, which is great, but lacks the ability out-of-the-box to share parts of those HTML files.
While a JS framework like React or Vue could be used to solve this problem, this is heavy-handed for a simple site that could be completely pre-rendered without a JS run-time of any kind.
Handlebars provides what we need to be able to stitch together multiple HTML files, interpolate variables, etc.
Start by installing the package like you would any other
yarn add -D vite-plugin-handlebars
It can then be added to your Vite configuration as a plugin:
// vite.config.js
import handlebars from 'vite-plugin-handlebars';
export default {
plugins: [handlebars()],
};
Configuring the plugin is covered later in this guide.
fs/promises
)If you want to make use of Handlebars Context to inject variables into your HTML file, you'll need to define their values in the context
object passed to the handlebars
plugin:
<!-- index.html -->
<h1>{{title}}</h1>
// vite.config.js
import handlebars from 'vite-plugin-handlebars';
export default {
plugins: [
handlebars({
context: {
title: 'Hello, world!',
},
}),
],
};
This will result in <h1>Hello, world!</h1>
in your output HTML file.
If you want to make use of partials in your HTML files, you must define the partialDirectory
option for the handlebars
plugin.
// vite.config.js
import { resolve } from 'path';
import handlebars from 'vite-plugin-handlebars';
export default {
plugins: [
handlebars({
partialDirectory: resolve(__dirname, 'partials'),
}),
],
};
If you want to use multiple partial folders, an array can be submitted.
Each file in these directories (.html
or .hbs
) will become registered as a partial. The name of the file is used to invoke it. So, with the above configuration and the following files:
<!-- partials/header.hbs -->
<header><a href="/">My Website</a></header>
<!-- index.html -->
{{> header }}
<h1>The Main Page</h1>
Your output website content would become:
<header><a href="/">My Website</a></header>
<h1>The Main Page</h1>
Make sure to review the quirks section for information on potentially-unexpected behavior.
All other Handlebars configuration options can also be passed through.
compileOptions
can be used to alter the compilation stepruntimeOptions
can be used to alter the rendering stepEach of these can also be passed through to the handlebars
plugin:
// vite.config.js
import handlebars from 'vite-plugin-handlebars';
export default {
plugins: [
handlebars({
compileOptions: {
// Example config option: avoid auto-indenting partials
preventIndent: true,
},
runtimeOptions: {
// Example config option: define custom private @variables
data: {
foo: 'bar',
},
},
}),
],
};
resolve-from-root
You can resolve a file path relative to the Vite root using the resolve-from-root
helper. This assists with injecting other files, like linking to a CSS file, within a partial.
<!-- partials/head.hbs -->
<link rel="stylesheet" href="{{resolve-from-root 'css/global.css'}}" />
resolve-from-root
helper to ensure paths are resolved from the project root, rather than relative to a particular file.FAQs
Vite plugin for Handlebars support in HTML
The npm package vite-plugin-handlebars receives a total of 9,813 weekly downloads. As such, vite-plugin-handlebars popularity was classified as popular.
We found that vite-plugin-handlebars demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.