Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The decomment npm package is used to remove comments from JavaScript, HTML, and CSS code. It helps in cleaning up code by stripping out unnecessary comments, which can be useful for production environments where comments are not needed.
Remove JavaScript Comments
This feature removes both block and inline comments from JavaScript code. The provided code sample demonstrates how to use decomment to clean a JavaScript string by removing comments.
const decomment = require('decomment');
const jsCode = '/* This is a comment */\nconst a = 5; // inline comment';
const cleanJsCode = decomment(jsCode);
console.log(cleanJsCode);
Remove HTML Comments
This feature removes comments from HTML code. The code sample shows how to use decomment to strip out comments from an HTML string.
const decomment = require('decomment');
const htmlCode = '<!-- This is a comment --><div>Content</div><!-- Another comment -->';
const cleanHtmlCode = decomment(htmlCode);
console.log(cleanHtmlCode);
Remove CSS Comments
This feature removes comments from CSS code. The code sample demonstrates how to use decomment to clean a CSS string by removing comments.
const decomment = require('decomment');
const cssCode = '/* This is a comment */\nbody { color: red; }';
const cleanCssCode = decomment(cssCode);
console.log(cleanCssCode);
The strip-comments package is used to remove comments from JavaScript, CSS, and HTML. It offers similar functionality to decomment but provides more granular control over the types of comments to remove, such as block, line, and safe comments.
UglifyJS is a JavaScript parser, minifier, compressor, and beautifier toolkit. While its primary purpose is to minify JavaScript code, it also removes comments in the process. It is more feature-rich compared to decomment but is focused mainly on JavaScript.
clean-css is a fast and efficient CSS optimizer that also removes comments as part of its optimization process. It is more specialized for CSS compared to decomment, offering advanced minification and optimization features.
Removes comments from JSON/JavaScript, CSS/HTML, CPP/H, etc.
$ npm i decomment
$ npm test
Testing with coverage:
$ npm run coverage
const decomment = require('decomment');
const code = 'var t; // comments';
decomment(code); //=> var t;
For build systems / task runners see gulp-decomment and grunt-decomment.
<!-- comments -->
from itThe library does not support mixed content - HTML with JavaScript or CSS in it. Once the input code is recognized as HTML, only the HTML comments will be removed from it.
For JSON and JavaScript this library uses esprima to guarantee correct processing for regular expressions.
As an example, it can process AngularJS 1.5 Core in under 100ms, which is 1.1MB ~ 30,000 lines of JavaScript.
This method first checks if the code starts with <
, as an HTML, and if so, all <!-- comment -->
entries
are removed, according to the options
.
When the code
is not recognized as HTML, it is assumed to be either JSON or JavaScript. It is then parsed
through esprima for ECMAScript 6 compliance, and to extract details about regular expressions.
If esprima fails to validate the code, it will throw a parsing error. When successful, this method will remove
//
and /**/
comments according to the options
(see below).
false (default)
- remove all multi-line commentstrue
- keep special multi-line comments that begin with:
<!--[if
- for conditional comments in HTML/*!
- for everything else (other than HTML)Example:
const decomment = require('decomment');
const code = '/*! special */ var a; /* normal */';
decomment(code); //=> var a;
decomment(code, {safe: true}); //=> /*! special */ var a;
Takes either a single or an array of regular expressions to match against. All matching blocks are then skipped, as well as any comment-like content inside them.
Examples:
src: url(data:font/woff;base64,d09GRg//ABAAAAAAZ)
You can isolate all url(*)
blocks by using:
{ignore: /url\([\w\s:\/=\-\+;,]*\)/g}
/**
, followed by a line break, end with */
),
you can use the following:{ignore: /\/\*\*\s*\n([^\*]|(\*(?!\/)))*\*\//g}
false (default)
- remove comment blocks entirelytrue
- replace comment blocks with white spaces where needed, in order to preserve
the original line + column position of every code element.Example:
const decomment = require('decomment');
const code = 'var a/*text*/, b';
decomment(code); //=> var a, b
decomment(code, {space: true}); //=> var a , b
NOTE: When this option is enabled, option trim
is ignored.
false (default)
- do not trim commentstrue
- remove empty lines that follow removed full-line commentsExample:
const decomment = require('decomment');
const code = '/* comment */\r\n\r\n var test = 123';
decomment(code); //=> \r\n var test = 123
decomment(code, {trim: true}); //=> var test = 123
NOTE: This option has no effect when option space
is enabled.
false (default)
- perform strict JavaScript parsing (parser throws on invalid JavaScript)true
- pass tolerant
flag to esprima parser (the parser may choose to continue parsing and produce a syntax tree).
Usefull for parsing Angular/TypeScript code, for example.Example:
const decomment = require('decomment');
const code = '/* comment */\r\n\r\n@Injectable()\r\nexport class HeroService {}';
decomment(code); //=> Error: 'Unexpected token ILLEGAL'
decomment(code, {tolerant: true}); //=> @Injectable()\r\nexport class HeroService {}
Unlike the default decomment, it instructs the library that text
is not a JSON,
JavaScript or HTML, rather a plain text that needs no parsing or validation,
only to remove //
and /**/
comments from it according to the options
.
This method is good for any text file that uses syntax //
and /**/
for comments,
such as: .CSS
, .CPP
, .H
, etc.
Example:
const decomment = require('decomment');
const text = '.my-class{color:Red;}// comments';
decomment.text(text); //=> .my-class{color:Red;}
Please note that while the same rules apply for the text blocks (''
, ""
and ``),
you should not use this method for JSON or JavaScript, as it can break your regular expressions.
Unlike the default decomment method, it instructs the library not to parse
or validate the input in any way, rather assume it to be HTML, and remove all
<!-- comment -->
entries from it according to the options
.
Returns End-of-Line string used within the text
, based on the occurrence frequency:
\n
- for Unix-encoded text\r\n
- for Windows-encoded textWhen impossible to conclude (the same or 0 occurrence), it returns the default End-of-Line for the current OS.
Copyright © 2021 Vitaly Tomilov; Released under the MIT license.
FAQs
Removes comments from JSON/JavaScript, CSS/HTML, CPP/H, etc.
We found that decomment demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.