
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
A Python library for parsing Aptos Move smart contract language, built on tree-sitter.
source: https://github.com/BradMoonUESTC/tree-sitter-move
Option 1: One-click Installation (Recommended)
./setup.sh
Option 2: Manual Installation
# Create and activate virtual environment
python3 -m venv venv
source venv/bin/activate
# Install dependencies
pip install tree-sitter --trusted-host pypi.org --trusted-host files.pythonhosted.org
# Install this package
pip install -e .
# Run demo
python move_parser_demo.py
# Run basic demo
python move_parser_demo.py
# Run comprehensive tests
python comprehensive_move_test.py
import tree_sitter_move as ts_move
from tree_sitter import Language, Parser
# Create parser
move_language = Language(ts_move.language())
parser = Parser()
parser.language = move_language
# Parse Move code
move_code = """
module 0x1::coin {
struct Coin has key, store {
value: u64,
}
public fun mint(value: u64): Coin {
Coin { value }
}
public fun get_value(coin: &Coin): u64 {
coin.value
}
}
"""
tree = parser.parse(bytes(move_code, "utf8"))
# Check parsing result
if tree.root_node.has_error:
print("❌ Syntax error")
else:
print("✅ Parsing successful")
print(f"Root node type: {tree.root_node.type}")
print(f"Number of child nodes: {tree.root_node.child_count}")
def analyze_ast(node, depth=0):
indent = " " * depth
print(f"{indent}├─ {node.type}")
for child in node.children:
if depth < 3: # Limit depth
analyze_ast(child, depth + 1)
# Analyze the AST structure
analyze_ast(tree.root_node)
The parser has been thoroughly tested with various Move code samples:
File | Size | Lines | Description | Result |
---|---|---|---|---|
basic_coin.move | 1.9KB | 58 | Basic coin module with mint/transfer functions | ✅ Pass |
nft_collection.move | 4.0KB | 150 | NFT collection with complex events and vectors | ✅ Pass |
defi_swap.move | 6.9KB | 203 | DeFi swap module with generics and algorithms | ✅ Pass |
script_example.move | 770B | 23 | Move script example | ✅ Pass |
syntax_error.move | 579B | 29 | File with intentional syntax errors | ❌ Fail (Expected) |
Overall Success Rate: 100% (4/4 valid files, 1 syntax error file correctly detected)
module 0x1::name
)has key, store
)public fun
)<T>
, phantom
)&
, &mut
)script { }
)use
)assert!
, abort
)move_to
, borrow_global
)event::emit
)tree-sitter-move/
├── src/ # Pre-compiled grammar files
│ ├── grammar.json # Grammar rules
│ ├── parser.c # Parser C code
│ └── scanner.c # External scanner
├── bindings/python/ # Python bindings
├── move_test_files/ # Test Move files
│ ├── basic_coin.move # Basic coin module
│ ├── nft_collection.move # NFT collection
│ ├── defi_swap.move # DeFi swap module
│ └── script_example.move # Script example
├── move_parser_demo.py # Basic demo script
├── comprehensive_move_test.py # Comprehensive test script
├── setup.py # Python package configuration
├── setup.sh # Installation script
└── README.md # This documentation
The parser generates complete Abstract Syntax Trees (AST) including:
pip install tree-sitter --trusted-host pypi.org --trusted-host files.pythonhosted.org --trusted-host pypi.python.org
pip install -e .
source venv/bin/activate
Apache License 2.0 - See LICENSE file for details
🎉 Enjoy using Tree-sitter Move Parser!
包配置完善
pyproject.toml
配置文件MANIFEST.in
文件管理包文件成功构建了两种分发包
tree_sitter_move-0.0.1-cp38-abi3-macosx_10_13_universal2.whl
tree_sitter_move-0.0.1.tar.gz
质量验证通过
twine check
验证通过<code_block_to_apply_from>
# 上传到Test PyPI(测试用)
twine upload --repository testpypi dist/*
# 上传到PyPI(正式发布)
twine upload dist/*
# 开发模式安装
pip install -e .
tree-sitter-move
0.0.1
tree-sitter>=0.21.0
import tree_sitter_move as ts_move
from tree_sitter import Language, Parser
# 创建解析器
move_language = Language(ts_move.language())
parser = Parser(move_language)
# 解析Move代码
code = "module 0x1::hello { public fun world() {} }"
tree = parser.parse(bytes(code, "utf8"))
print("✅ 解析成功!" if not tree.root_node.has_error else "❌ 解析失败")
详细的安装和使用指南已保存在 PACKAGING_GUIDE.md
文件中。
现在您的tree-sitter-move包已经可以:
🎊 恭喜!您已经成功创建了一个可分发的Python包!
FAQs
Move grammar for tree-sitter
We found that tree-sitter-move demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.