Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

apply-html

Package Overview
Dependencies
Maintainers
1
Versions
27
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

apply-html

It's `.innerHTML = ''` for the 21st century.

  • 2.0.0-1
  • next
  • Source
  • npm
  • Socket score

Version published
Maintainers
1
Created
Source

apply-html

NPM version Downloads Build Status Coverage Status

It's .innerHTML = '' for the 21st century!

Yet another library to diff and patch an existing DOM tree by efficiently comparing it to a string. Why? This library is a little bit different than others. It makes use of an HTML <template>'s unique ability to create an inert document fragment, featuring:

  • A real DOM tree
  • Multiple root nodes
  • Will not trigger resource loading prematurely
  • Will not apply embedded stylesheets prematurely
  • Will not trigger custom element constructors or lifecycle events prematurely

The live DOM is then patched with the inert fragment using a hyper-fast diffing algorithm for real DOM nodes. This ensures that things only start happening if and when they're supposed to, organically.

Play with it on CodePen.

Install

$ npm install --save apply-html

or

<script src="https://wzrd.in/standalone/apply-html"></script>

or

<script type="module">
    import { apply, html } from 'https://unpkg.com/apply-html?module';
</script>

Usage

Patching

const { apply } = require('apply-html');

apply(document.body, '<h1 class="day">Hello World</h1>');

console.log(document.body.innerHTML);
// -> <h1 class="day">Hello World</h1>

apply(document.body, '<h1 class="night">Goodnight Moon</h1>');

console.log(document.body.innerHTML);
// -> <h1 class="night">Goodnight Moon</h1>

Interpolation and Escaping

const { apply, html, raw } = require('apply-html');

const foo = '<em>foo</em>';
const bar = raw('<em>bar</em>');
const baz = html`<strong>baz</strong>`;

apply(document.body, html`
    ${foo}
    ${bar}
    ${baz}
`);

console.log(document.body.innerHTML);
// -> &lt;em&gt;foo&lt;/em&gt;
// -> <em>bar</em>
// -> <strong>baz</strong>

Server-side Rendering

The html and raw functions never touch the DOM so they're completely safe to use server-side.

const http = require('http');
const { html } = require('apply-html');

const content = html`
    <h1>Hello <em>World</em></h1>
    <p>How are you today?</p>
`;

module.exports = http
    .createServer((req, res) => res.end(content.toString()))
    .listen(3000);

API

apply(element, string): Element

  • element {Element} DOM element with children to be patched.
  • string {String|SafeString} String or SafeString containing safe HTML to render.

Updates the content of the given element, making the fewest possible changes required to match the given string of HTML. The string is converted into an HTML <template> and the resulting DOM trees are compared. Returns the updated element.

html`string`: SafeString

A template tag that creates a new SafeString containing a string of HTML. Interpolated values are serialized based on type:

  • Array - Items are serialized then joined with an empty string ('').
  • Boolean|null|undefined - Converted to an empty string ('').
  • Function - Throws a TypeError.
  • Number - Inserted as-is.
  • Object - Converted to an HTML-escaped JSON blob.
  • SafeString - Inserted as-is.
  • String - HTML-escaped to safeguard against XSS. To opt out of escaping, use raw().

raw(string): SafeString

  • string {String} String of safe HTML.

Wraps a string in a SafeString to indicate that it's safe to be inserted into the document. Only use on trusted strings to safeguard against XSS.

SafeString

.raw {String}

The wrapped string.

.length {Number}

Length of the wrapped string. Read only.

.toJSON(): String

Returns the raw string.

.toString(): String

Returns the raw string.

Acknowledgements

Standing on the shoulders of these giants:


MIT © Shannon Moeller

Keywords

FAQs

Package last updated on 02 Aug 2018

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc