
Security News
TeamPCP and BreachForums Launch $1,000 Contest for Supply Chain Attacks
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.
Use Pug to transform XML, instead of XSLT. Why? At my office, we call the XSLT book the Token of Pain. Whoever touched the XSLT code last has it on their desk, and is responsible for being the current expert. That person hates their life until someone else needs the book badly enough to take on the pain.
Also, you can't easily generate HTML5 with XSLT because of the doctype and tags
like <meta> that don't get closed.
npm install -g xmlpug
Write templates like this:
doctype html
html
head
meta(charset='utf-8')
meta(name='author', content=$$('front/author/@fullname'))
title= $('front/title/text()')
where the $ and $$ functions perform xpath queries in a source XML document. $ returns the first match, or null. $$ always returns an array of all of the matches. So given the following XML input:
<rfc>
<front>
<title abbrev="HTML RFC">HyperText Markup Language Request For Comments Format</title>
<author initials="J." surname="Hildebrand" fullname="Joe Hildebrand" role="editor"/>
<author initials="H." surname="Flanagan" fullname="Heather Flanagan" role="editor"/>
</front>
</rfc>
the above template would generate:
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="author" content="Joe Hildebrand,Heather Flanagan">
<title>HyperText Markup Language Request For Comments Format</title>
</head>
</html>
The added JavaScript features available in the template are:
$(string, element): perform an XPath query against the input document, returning the first match. Text nodes are converted to strings, and attribute nodes are converted to the string versions of their values. If no matches are found, returns null. If an element is provided, search within that element, otherwise search from the root of the input document.$$(string, element): perform an XPath query against the input document, returning all of the matches as an array. Text nodes are converted to strings, and attribute nodes are converted to the string versions of their values. If no matches are found, returns []. If an element is provided, search within that element, otherwise search from the root of the input document.$att(element, string): gets the text value of an attribute from an element with the name specified in the string. Returns null on errors.$source: a Buffer containing the original XML source before parsingrequire(string): wrapper around normal node require allowing it to work in a template. Can import ES6 modules that
have no async in the load path.version: the name and version number of xmlpugUsage: xmlpug [options] <template> [input...]
Options:
-V, --version output the version number
-c, --config <file> Config file to read (default: "./.xmlpug.json")
-C, --colors Force color output
--no-colors Force non-color output
-d, --debug Add Pug debug information
-D, --define <name=string> Define a global variable (default: {})
-o, --output <file> Output file (default: "-")
-p, --pretty Pretty print
-q, --doublequote Use doublequotes instead of single
--html HTML output; only useful for pretty printing
--xml Force XML output for XHTML
-h, --help display help for command
Full API docs are available.
FAQs
Transform XML documents with Pug templates
We found that xmlpug demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.

Research
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.