registry / @flun/html-template / 5.0.31

@flun/html-template@5.0.31

一个HTML模板工具包,提供开发服务器和模板编译功能,支持自定义标签和快捷输入,变量定义,包含文件引用,帮助开发者模块化处理HTML;

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 325 KB of source, external domains: work.weixin.qq.com, www.npmjs.com

Source & flagged code

5 flagged

package.jsonView file

Lines 54-76json

54 "chokidar": "^5.0.0",

55 "express": "^5.2.1",

56 "express-rate-limit": "^8.5.2",

57 "express-session": "^1.19.0",

58 "@flun/env": "^3.1.22",

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node copy-files.js 2>&1

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node copy-files.js 2>&1

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

static/utils/foldgutter.jsView file

3(function (mod) { L4: if (typeof exports == "object" && typeof module == "object") mod(require("../../lib/codemirror"), require("./foldcode")); L5: else if (typeof define == "function" && define.amd) define(["../../lib/codemirror", "./foldcode"], mod);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

static/utils/foldgutter.jsView on unpkg · L3

services/templateService.jsView file

29*/ L30: const CWD = process.cwd(), templatesDir = 'templates', staticDir = 'static', customizeDir = 'customize', L31: accountDir = 'account', defaultPort = 7296; ... L126: * 2. 函数参数 (options.port) L127: * 3. 环境变量 (process.env.PORT) L128: * 4. 默认值 (常量 defaultPort)

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

services/templateService.jsView on unpkg · L29

compile.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @flun/html-template@5.0.26 matchedIdentity = npm:QGZsdW4vaHRtbC10ZW1wbGF0ZQ:5.0.26 similarity = 0.778 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

compile.jsView on unpkg

Findings

2 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltacompile.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirestatic/utils/foldgutter.js

MediumUnsafe Vm Contextservices/templateService.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

static/utils/foldgutter.jsView file

Lines 1-23javascript

1// CodeMirror库 - 折叠处理逻辑的优化和扩展 (https://cdnjs.cloudflare.com/ajax/libs/codemirror/6.65.7/addon/fold/foldgutter.min.js)

3(function (mod) {

4 if (typeof exports == "object" && typeof module == "object") mod(require("../../lib/codemirror"), require("./foldcode"));

5 else if (typeof define == "function" && define.amd) define(["../../lib/codemirror", "./foldcode"], mod);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

static/utils/foldgutter.jsView on unpkg · L3

6 else mod(CodeMirror);

7})((CodeMirror) => {

8 "use strict";

10 class State {

11 constructor(options) {

12 this.options = options, this.from = 0, this.to = 0;

13 }

14 };

16 CodeMirror.defineOption("foldGutter", false, (cm, val, old) => {

17 if (old && old != CodeMirror.Init) {

18 cm.clearGutter(cm.state.foldGutter.options.gutter), cm.state.foldGutter = null;

19 cm.off("gutterClick", onGutterClick).off("changes", onChange).off("viewportChange", onViewportChange)

20 .off("fold", onFold).off("unfold", onFold).off("swapDoc", onChange);

21 }

22 if (val) {

23 cm.state.foldGutter = new State(parseOptions(val)), updateInViewport(cm, cm.state.foldGutter);

services/templateService.jsView file

Lines 9-49javascript

9 * 5. 模板功能处理系统：变量动态替换、函数执行、条件判断和循环处理

10 * 6. 模板结构验证：标签完整性检查

11 * 7. 模板文件操作：路径获取

12 * 8. 模板渲染引擎核心：模板合成,文件验证,渲染

13 * 9. 模块功能导出

14 */

15import fs from 'fs';

16import path from 'path';

17import vm from 'vm';

18import { pathToFileURL } from 'url';

19// ==================== 1. 常量声明及工具函数====================

20let isCompilationMode = false;

21/**

22 * fs模块的Promise版本,用于异步文件操作

23 * >查看定义:@see {@link fsPromises}

24 */

25const fsPromises = fs.promises;

26/**

27 * 当前工作目录

28 * >查看定义:@see {@link CWD}、{@link templatesDir}、{@link staticDir}、{@link customizeDir}、{@link accountDir}、{@link defaultPort}

29 */

30const CWD = process.cwd(), templatesDir = 'templates', staticDir = 'static', customizeDir = 'customize',

31 accountDir = 'account', defaultPort = 7296;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

services/templateService.jsView on unpkg · L29

32/**

33 * 模板文件绝对路径

34 * >查看定义:@see {@link templatesAbsDir}

35 */

36const templatesAbsDir = path.join(CWD, templatesDir);

37/**

38 * 路径解析函数

39 * >查看定义:@see {@link pRes}

40 */

41const pRes = path.resolve;

42/**

43 * 已写入文件忽略列表（监控文件写入时使用,防止编译器误触发重新编译）

44 * >查看定义:@see {@link writtenFilesToIgnore}

45 */

46const writtenFilesToIgnore = [], userFeatures = {}, includedFiles = new Set(),

47 // 预编译所有高频正则表达式

48 includeRegex = /(\"|')\[include\s+([^\]]+)\](\"|')|\[include\s+([\S\s]+?)\]/gi, quotedVarRegex = /`\s*{{(.*?)}}\s*`/g

49 userFuncRegex = /\{\{\s*user:\s*([^\s()]+?)\s*\(([^)]*)\)\s*\}\}/g, templateTagRegex = /\[!([^\]]*?)\]|\[\~([