Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Implements a parser for HCL (HashiCorp Configuration Language) <https://github.com/hashicorp/hcl>
__ in Python. This
implementation aims to be compatible with the original golang version of
the parser.
pyhcl does not support HCL2 (which is what modern terraform uses). You might try https://pypi.org/project/python-hcl2/ instead (though I've never personally tried it).
The grammar and many of the tests/fixtures were copied/ported from the golang parser into pyhcl. All releases are tested with a variety of python versions from Python 2.7 onward.
This version has been modified to work with terraform 0.12 syntax.
It should be backward compatible with earlier versions.
It doesn't cover every situation. See discussion in pull request:
https://github.com/virtuald/pyhcl/pull/57
::
pip install pyhcl
This module is intended to be used in mostly the same way that one would use the json module in python, and load/loads/dumps are implemented.
::
import hcl
with open('file.hcl', 'r') as fp:
obj = hcl.load(fp)
Currently the dumps function outputs JSON, and not HCL.
pyhcl comes with a script that you can use to easily convert HCL to JSON, similar to the json.tool that comes with python::
hcltool INFILE [OUTFILE]
Similar to JSON, the output of parsing HCL is a python dictionary with no defined structure. The golang library for HCL implements support for parsing HCL according to defined objects, but this implementation does not currently support such constructs.
Instead, I recommend that you use tools designed to validate JSON, such
as the schematics <https://pypi.python.org/pypi/schematics>
_ library.
Single line comments start with #
or //
Multi-line comments are wrapped in /*
and */
Values are assigned with the syntax key = value
(whitespace
doesn't matter). The value can be any primitive: a string, number,
boolean, object, or list.
Strings are double-quoted and can contain any UTF-8 characters.
Example: "Hello, World"
Numbers are assumed to be base 10. If you prefix a number with 0x, it is treated as a hexadecimal. If it is prefixed with 0, it is treated as an octal. Numbers can be in scientific notation: "1e10".
Boolean values: true
, false
Arrays can be made by wrapping it in []
. Example:
["foo", "bar", 42]
. Arrays can contain primitives and other
arrays, but cannot contain objects. Objects must use the block syntax
shown below.
Objects and nested objects are created using the structure shown below::
variable "ami" {
description = "the AMI to use"
}
To run the tests::
pip install -r testing-requirements.txt
tests/run_tests.sh
To enable debug mode::
import hcl
hcl.parser.DEBUG = True
Dustin Spicuzza (dustin@virtualroadside.com)
Note: This project is not associated with Hashicorp
FAQs
HCL configuration parser for python
We found that pyhcl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.