Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@chlodalejandro/parsoid
Advanced tools
A userscript library for easily handling Parsoid DOM trees.
Originally from User:Chlod/Scripts/ParsoidDocument on the English Wikipedia.
ParsoidDocument is an ES9+ library which implements a Parsoid-compatible document handler using an HTML5 IFrame. It is not a userscript, but is instead loaded by other userscripts. The IFrame contains the Parsoid document, which can then be modified using standard DOM functions. This is used to perform Parsoid-dependent operations in the browser without having to pull in the entirety of the VisualEditor codebase. The library works even without the existence of MediaWiki notification
and Title
modules, although they are helpful in ensuring data stability.
To be fully optimized, this should be implemented as a gadget and loaded through mw.loader. Note that some APIs used by this library may not be available on older browsers.
As a developer, insert the following code in the initialization section of your userscript. This is the only way to use the library on the English Wikipedia, and for most Wikimedia wikis.
// The "await" is optional, but ensures that the script has loaded and run before proceeding.
// On the English Wikipedia
await mw.loader.getScript("https://en.wikipedia.org/wiki/User:Chlod/Scripts/ParsoidDocument.js?action=raw&ctype=text/javascript");
// On other wikis, you must upload ParsoidDocument.js from the English Wikipedia or this repository
// first, and then change the URL to lead to the correct page. Make sure to keep the
// `?action=raw&ctype=text/javascript` at the end of the URL!
If it is available as a gadget, you can instead use the following.
mw.loader.load("ext.gadget.ParsoidDocument"); // where ParsoidDocument is the ID of the gadget.
If your userscript is bundled with Webpack, you can also install the @chlodalejandro/parsoid package. This package also adds typings for ParsoidDocument, in case you're developing with TypeScript or a decent IDE with a type checker.
npm install @chlodalejandro/parsoid
You can then access ParsoidDocument using the ParsoidDocument
window global.
const parsoid = new ParsoidDocument();
parsoid.loadPage("User:Chlod/Scripts/ParsoidDocument");
parsoid.document.body.classList.contains("parsoid-body"); // true
// Prints the "data-mw" attribute of all transclusions.
parsoid.document.querySelectorAll("[typeof=\"mw:Transclusion\"]").forEach(v => {
console.log(v.getAttribute("data-mw"));
});
// Convert the document, including any modification, to wikitext.
parsoid.toWikitext();
You can also extend the ParsoidDocument class as any other class.
class MyParsoidHandler extends ParsoidDocument {
findAllTransclusions() {
return this.document.querySelectorAll("[typeof=\"mw:Transclusion\"]");
}
}
const parsoid = new MyParsoidHandler();
// ...
parsoid.findAllTransclusions();
mw
).FAQs
A userscript library for easily handling Parsoid DOM trees.
The npm package @chlodalejandro/parsoid receives a total of 37 weekly downloads. As such, @chlodalejandro/parsoid popularity was classified as not popular.
We found that @chlodalejandro/parsoid demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.