Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Removes comments from JSON/JavaScript, CSS/HTML, CPP/H, etc.
$ npm i decomment
$ npm test
Testing with coverage:
$ npm run coverage
const decomment = require('decomment');
const code = 'var t; // comments';
decomment(code); //=> var t;
For build systems / task runners see gulp-decomment and grunt-decomment.
<!-- comments -->
from itThe library does not support mixed content - HTML with JavaScript or CSS in it. Once the input code is recognized as HTML, only the HTML comments will be removed from it.
For JSON and JavaScript this library uses esprima to guarantee correct processing for regular expressions.
As an example, it can process AngularJS 1.5 Core in under 100ms, which is 1.1MB ~ 30,000 lines of JavaScript.
This method first checks if the code starts with <
, as an HTML, and if so, all <!-- comment -->
entries
are removed, according to the options
.
When the code
is not recognized as HTML, it is assumed to be either JSON or JavaScript. It is then parsed
through esprima for ECMAScript 6 compliance, and to extract details about regular expressions.
If esprima fails to validate the code, it will throw a parsing error. When successful, this method will remove
//
and /**/
comments according to the options
(see below).
false (default)
- remove all multi-line commentstrue
- keep special multi-line comments that begin with:
<!--[if
- for conditional comments in HTML/*!
- for everything else (other than HTML)Example:
const decomment = require('decomment');
const code = '/*! special */ var a; /* normal */';
decomment(code); //=> var a;
decomment(code, {safe: true}); //=> /*! special */ var a;
Takes either a single or an array of regular expressions to match against. All matching blocks are then skipped, as well as any comment-like content inside them.
Examples:
src: url(data:font/woff;base64,d09GRg//ABAAAAAAZ)
You can isolate all url(*)
blocks by using:
{ignore: /url\([\w\s:\/=\-\+;,]*\)/g}
/**
, followed by a line break, end with */
),
you can use the following:{ignore: /\/\*\*\s*\n([^\*]|(\*(?!\/)))*\*\//g}
false (default)
- remove comment blocks entirelytrue
- replace comment blocks with white spaces where needed, in order to preserve
the original line + column position of every code element.Example:
const decomment = require('decomment');
const code = 'var a/*text*/, b';
decomment(code); //=> var a, b
decomment(code, {space: true}); //=> var a , b
NOTE: When this option is enabled, option trim
is ignored.
false (default)
- do not trim commentstrue
- remove empty lines that follow removed full-line commentsExample:
const decomment = require('decomment');
const code = '/* comment */\r\n\r\n var test = 123';
decomment(code); //=> \r\n var test = 123
decomment(code, {trim: true}); //=> var test = 123
NOTE: This option has no effect when option space
is enabled.
false (default)
- perform strict JavaScript parsing (parser throws on invalid JavaScript)true
- pass tolerant
flag to esprima parser (the parser may choose to continue parsing and produce a syntax tree).
Usefull for parsing Angular/TypeScript code, for example.Example:
const decomment = require('decomment');
const code = '/* comment */\r\n\r\n@Injectable()\r\nexport class HeroService {}';
decomment(code); //=> Error: 'Unexpected token ILLEGAL'
decomment(code, {tolerant: true}); //=> @Injectable()\r\nexport class HeroService {}
Unlike the default decomment, it instructs the library that text
is not a JSON,
JavaScript or HTML, rather a plain text that needs no parsing or validation,
only to remove //
and /**/
comments from it according to the options
.
This method is good for any text file that uses syntax //
and /**/
for comments,
such as: .CSS
, .CPP
, .H
, etc.
Example:
const decomment = require('decomment');
const text = '.my-class{color:Red;}// comments';
decomment.text(text); //=> .my-class{color:Red;}
Please note that while the same rules apply for the text blocks (''
, ""
and ``),
you should not use this method for JSON or JavaScript, as it can break your regular expressions.
Unlike the default decomment method, it instructs the library not to parse
or validate the input in any way, rather assume it to be HTML, and remove all
<!-- comment -->
entries from it according to the options
.
Returns End-of-Line string used within the text
, based on the occurrence frequency:
\n
- for Unix-encoded text\r\n
- for Windows-encoded textWhen impossible to conclude (the same or 0 occurrence), it returns the default End-of-Line for the current OS.
Copyright © 2021 Vitaly Tomilov; Released under the MIT license.
FAQs
Removes comments from JSON/JavaScript, CSS/HTML, CPP/H, etc.
The npm package decomment receives a total of 62,760 weekly downloads. As such, decomment popularity was classified as popular.
We found that decomment demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.