
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
A python implementation of the mustache templating language.
I'm glad you asked!
Chevron runs in less than half the time of pystache (Which is not even up to date on the spec). And in about 70% the time of Stache (A 'trimmed' version of mustache, also not spec compliant).
The flake8 command is run by travis to ensure consistency.
Chevron passes all the unittests provided by the spec (in every version listed below).
If you find a test that chevron does not pass, please report it.
Python 2.6, 2.7, 3.2, 3.3, 3.4, 3.5, and 3.6 are all tested by travis.
Commandline usage: (if installed via pypi)
usage: chevron [-h] [-v] [-d DATA] [-p PARTIALS_PATH] [-e PARTIALS_EXT]
[-l DEF_LDEL] [-r DEF_RDEL]
template
positional arguments:
template The mustache file
optional arguments:
-h, --help show this help message and exit
-v, --version show program's version number and exit
-d DATA, --data DATA The json data file
-p PARTIALS_PATH, --path PARTIALS_PATH
The directory where your partials reside
-e PARTIALS_EXT, --ext PARTIALS_EXT
The extension for your mustache partials, 'mustache'
by default
-l DEF_LDEL, --left-delimiter DEF_LDEL
The default left delimiter, "{{" by default.
-r DEF_RDEL, --right-delimiter DEF_RDEL
The default right delimiter, "}}" by default.
Python usage with strings
import chevron
chevron.render('Hello, {{ mustache }}!', {'mustache': 'World'})
Python usage with file
import chevron
with open('file.mustache', 'r') as f:
chevron.render(f, {'mustache': 'World'})
Python usage with unpacking
import chevron
args = {
'template': 'Hello, {{ mustache }}!',
'data': {
'mustache': 'World'
}
}
chevron.render(**args)
chevron supports partials (via dictionaries)
import chevron
args = {
'template': 'Hello, {{> thing }}!',
'partials_dict': {
'thing': 'World'
}
}
chevron.render(**args)
chevron supports partials (via the filesystem)
import chevron
args = {
'template': 'Hello, {{> thing }}!',
# defaults to .
'partials_path': 'partials/',
# defaults to mustache
'partials_ext': 'ms',
}
# ./partials/thing.ms will be read and rendered
chevron.render(**args)
chevron supports lambdas
import chevron
def first(text, render):
# return only first occurance of items
result = render(text)
return [ x.strip() for x in result.split(" || ") if x.strip() ][0]
def inject_x(text, render):
# inject data into scope
return render(text, {'x': 'data'})
args = {
'template': 'Hello, {{# first}} {{x}} || {{y}} || {{z}} {{/ first}}! {{# inject_x}} {{x}} {{/ inject_x}}',
'data': {
'y': 'foo',
'z': 'bar',
'first': first,
'inject_x': inject_x
}
}
chevron.render(**args)
$ git clone https://github.com/noahmorrison/chevron.git
or using submodules
$ git submodules add https://github.com/noahmorrison/chevron.git
Also available on pypi!
$ pip install chevron
FAQs
Mustache templating language renderer
We found that chevron demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.