Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Removes comments from JSON, JavaScript, CSS, HTML, etc.
$ npm install decomment
$ npm test
Testing with coverage:
$ npm run coverage
var decomment = require('decomment');
var code = "var t; // comments";
decomment(code); //=> var t;
For build systems / task runners see gulp-decomment and grunt-decomment.
<!-- comments -->
from itThe library does not support mixed content - HTML with JavaScript or CSS in it. Once the input code is recognized as HTML, only the HTML comments will be removed from it.
For JSON and JavaScript this library uses esprima to guarantee correct processing for regular expressions.
As an example, it can process AngularJS 1.5 Core in under 100ms, which is 1.1MB ~ 30,000 lines of JavaScript.
This method first checks if the code starts with <
, as an HTML, and if so,
all <!-- comment -->
entries are removed, according to the options
.
When the code
is not recognized as HTML, it is assumed to be either JSON or JavaScript.
It is then parsed through esprima for ECMAScript 6 compliance, and to extract details
about regular expressions.
If esprima fails to validate the code, it will throw a parsing error. When successful,
this method will remove //
and /**/
comments according to the options
(see below).
false (default)
- remove all multi-line commentstrue
- keep multi-line comments that start with /*!
Example:
var decomment = require('decomment');
var code = "/*! special */ var a; /* normal */";
decomment(code); //=> var a;
decomment(code, {safe: true}); //=> /*! special */ var a;
NOTE: This option has no effect when processing HTML.
false (default)
- remove comment blocks entirelytrue
- replace comment blocks with white spaces where needed, in order to preserve
the original line + column position of every code element.Example:
var decomment = require('decomment');
var code = "var a/*text*/, b";
decomment(code); //=> var a, b
decomment(code, {space: true}); //=> var a , b
NOTE: When this option is enabled, option trim
is ignored.
false (default)
- do not trim commentstrue
- remove empty lines that follow removed full-line commentsExample:
var decomment = require('decomment');
var code = "/* comment */\r\n\r\n var test = 123";
decomment(code); //=> \r\n var test = 123
decomment(code, {trim: true}); //=> var test = 123
NOTE: This option has no effect when option space
is enabled.
Unlike the default decomment, it instructs the library that text
is not a JSON,
JavaScript or HTML, rather a plain text that needs no parsing or validation,
only to remove //
and /**/
comments from it according to the options
.
This method is good for any text file that uses syntax //
and /**/
for comments,
such as: .CSS
, .CPP
, .H
, etc.
Example:
var decomment = require('decomment');
var text = ".my-class{color:Red;}// comments";
decomment.text(text); //=> .my-class{color:Red;}
Please note that while the same rules apply for the text blocks (''
, ""
and ``),
you should not use this method for JSON or JavaScript, as it can break your regular expressions.
Unlike the default decomment method, it instructs the library not to parse
or validate the input in any way, rather assume it to be HTML, and remove all
<!-- comment -->
entries from it according to the options
.
Copyright © 2016 Vitaly Tomilov; Released under the MIT license.
FAQs
Removes comments from JSON/JavaScript, CSS/HTML, CPP/H, etc.
We found that decomment demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.