Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Removes comments from JSON/JavaScript, CSS/HTML, CPP/H, etc.
$ npm i decomment
$ npm test
Testing with coverage:
$ npm run coverage
const decomment = require('decomment');
const code = 'var t; // comments';
decomment(code); //=> var t;
For build systems / task runners see gulp-decomment and grunt-decomment.
<!-- comments -->
from itThe library does not support mixed content - HTML with JavaScript or CSS in it. Once the input code is recognized as HTML, only the HTML comments will be removed from it.
For JSON and JavaScript this library uses esprima to guarantee correct processing for regular expressions.
As an example, it can process AngularJS 1.5 Core in under 100ms, which is 1.1MB ~ 30,000 lines of JavaScript.
This method first checks if the code starts with <
, as an HTML, and if so, all <!-- comment -->
entries
are removed, according to the options
.
When the code
is not recognized as HTML, it is assumed to be either JSON or JavaScript. It is then parsed
through esprima for ECMAScript 6 compliance, and to extract details about regular expressions.
If esprima fails to validate the code, it will throw a parsing error. When successful, this method will remove
//
and /**/
comments according to the options
(see below).
false (default)
- remove all multi-line commentstrue
- keep special multi-line comments that begin with:
<!--[if
- for conditional comments in HTML/*!
- for everything else (other than HTML)Example:
const decomment = require('decomment');
const code = '/*! special */ var a; /* normal */';
decomment(code); //=> var a;
decomment(code, {safe: true}); //=> /*! special */ var a;
Takes either a single or an array of regular expressions to match against. All matching blocks are then skipped, as well as any comment-like content inside them.
Examples:
src: url(data:font/woff;base64,d09GRg//ABAAAAAAZ)
You can isolate all url(*)
blocks by using:
{ignore: /url\([\w\s:\/=\-\+;,]*\)/g}
/**
, followed by a line break, end with */
),
you can use the following:{ignore: /\/\*\*\s*\n([^\*]|(\*(?!\/)))*\*\//g}
false (default)
- remove comment blocks entirelytrue
- replace comment blocks with white spaces where needed, in order to preserve
the original line + column position of every code element.Example:
const decomment = require('decomment');
const code = 'var a/*text*/, b';
decomment(code); //=> var a, b
decomment(code, {space: true}); //=> var a , b
NOTE: When this option is enabled, option trim
is ignored.
false (default)
- do not trim commentstrue
- remove empty lines that follow removed full-line commentsExample:
const decomment = require('decomment');
const code = '/* comment */\r\n\r\n var test = 123';
decomment(code); //=> \r\n var test = 123
decomment(code, {trim: true}); //=> var test = 123
NOTE: This option has no effect when option space
is enabled.
false (default)
- perform strict JavaScript parsing (parser throws on invalid JavaScript)true
- pass tolerant
flag to esprima parser (the parser may choose to continue parsing and produce a syntax tree).
Usefull for parsing Angular/TypeScript code, for example.Example:
const decomment = require('decomment');
const code = '/* comment */\r\n\r\n@Injectable()\r\nexport class HeroService {}';
decomment(code); //=> Error: 'Unexpected token ILLEGAL'
decomment(code, {tolerant: true}); //=> @Injectable()\r\nexport class HeroService {}
Unlike the default decomment, it instructs the library that text
is not a JSON,
JavaScript or HTML, rather a plain text that needs no parsing or validation,
only to remove //
and /**/
comments from it according to the options
.
This method is good for any text file that uses syntax //
and /**/
for comments,
such as: .CSS
, .CPP
, .H
, etc.
Example:
const decomment = require('decomment');
const text = '.my-class{color:Red;}// comments';
decomment.text(text); //=> .my-class{color:Red;}
Please note that while the same rules apply for the text blocks (''
, ""
and ``),
you should not use this method for JSON or JavaScript, as it can break your regular expressions.
Unlike the default decomment method, it instructs the library not to parse
or validate the input in any way, rather assume it to be HTML, and remove all
<!-- comment -->
entries from it according to the options
.
Returns End-of-Line string used within the text
, based on the occurrence frequency:
\n
- for Unix-encoded text\r\n
- for Windows-encoded textWhen impossible to conclude (the same or 0 occurrence), it returns the default End-of-Line for the current OS.
Copyright © 2021 Vitaly Tomilov; Released under the MIT license.
FAQs
Removes comments from JSON/JavaScript, CSS/HTML, CPP/H, etc.
The npm package decomment receives a total of 37,537 weekly downloads. As such, decomment popularity was classified as popular.
We found that decomment demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.