Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Because Kajiki's input is XML, it can ensure that your HTML/XML output is well-formed. The Genshi-like syntax, based on XML attributes or tags, is simply beautiful and easily understood (or ignored) by web designers. But instead of the slow performance of Genshi_, Kajiki compiles templates to Python code that renders with blazing-fast speed, so Kajiki can compete with the speed of Jinja_, Mako_, Chameleon_ and others. Also, one of Genshi's misfeatures -- py:match -- is replaced with blocks which work like Jinja's blocks.
By combining the best ideas out there -- XML input, Genshi's syntax and features, Jinja's template inheritance and final compilation to Python --, Kajiki is ready to become the most widely used templating engine for web development in Python. And more features are coming soon; stay tuned!
.. code:: python
>>> import kajiki
>>> Template = kajiki.XMLTemplate('''<html>
... <head><title>$title</title></head>
... <body>
... <h1>$title</h1>
... <ul>
... <li py:for="x in range(repetitions)">$title</li>
... </ul>
... </body>
... </html>''')
>>> print(Template(dict(title='Kajiki is teh awesome!', repetitions=3)).render())
<html>
<head><title>Kajiki is teh awesome!</title></head>
<body>
<h1>Kajiki is teh awesome!</h1>
<ul>
<li>Kajiki is teh awesome!</li><li>Kajiki is teh awesome!</li><li>Kajiki is teh awesome!</li>
</ul>
</body>
</html>
Documentation_
Kajiki is licensed under an MIT-style license_.
The git repository and issue tracker
_ are at GitHub_. Previously the project
used SourceForge_ for the hg repository, issue tracker and forums.
.. _Documentation: https://docs.kajiki.io/
.. _license: https://github.com/jackrosenthal/kajiki/blob/master/LICENSE.rst
.. _issue tracker
: https://github.com/jackrosenthal/kajiki/issues
.. _GitHub: https://github.com/jackrosenthal/kajiki
.. _SourceForge: http://sourceforge.net/p/kajiki/
.. _Genshi: https://pypi.python.org/pypi/Genshi
.. _Jinja: https://pypi.python.org/pypi/Jinja2
.. _Mako: https://pypi.python.org/pypi/Mako
.. _Chameleon: https://pypi.python.org/pypi/Chameleon
kajiki
package: tests are
now under the tests/
directory.ERROR LOOKING UP LINE
messages).<?xml ...?>
declaration
anymore.nine
dropped... note::
Kajiki 0.9.x will be the last series to support Python 3.4 and 3.5. Users are encouraged to upgrade to Python 3.6+ soon.
kajiki
command line interface.. note::
Kajiki 0.8.3 will be the last release to support Python 2.7. Kajiki 0.9 will require Python 3.4+.
${}
expressions and fix syntax errors reporting in braced expressions.gettext
function by providing it in the template context or through base_globals
in Loaderextract_python
option will now report syntax errors when extracting text for translation.extract_python
option to babel message extractor, this allows extracting gettext calls in ${}
expressionsstrip_text
option in loaderpy:switch
error message wrongly mentioning py:with
${}
expressionsstrip_text
option to XMLTemplate and i18n collector to ensure leading and trailing spaces are stipped by text nodes (also leads to minified HTML))
py:attrs
will now emit the attribute name itself or will omit the attribute at all in case of
bool
values for 'checked', 'disabled', 'readonly', 'multiple', 'selected', 'nohref',
'ismap', 'declare' and 'defer',py:switch
now correctly supports multiple py:case
statements.<script>
and <style>
tags is no longer collected translation.py:swtich
discards all its content apart from py:case
and py:else
statements it will now correctly report an error when the statements has other content.py:else
will now correctly detect spurious content between itself and py:if
as the two must be consequential.py:with
statement now keeps order of variables, so that variables can depend from each other.py:with
statement now accepts multiple variables separated by semicoloncdata_scripts=False
option in XMLTemplate
allows disabling automatic CDATA for script and style tags.py:def
: Do not crash if a function has no content.py:strip=''
is the same as py:strip='True'
.FAQs
Fast XML-based template engine with Genshi syntax and Jinja blocks
We found that kajiki demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.