Security News
Input Validation Vulnerabilities Dominate MITRE's 2024 CWE Top 25 List
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Domm is a small library to create safe HTML and DOM nodes using ES6 template literals.
It's lightweight and relies on native JS functionality. For anything non-trivial, this doesn't compete with a real template language like pug, or a library like react.
npm install --save domm
const D = require('domm');
D.html`<h1>Hello World!</h1>`;
// => '<h1>Hello World!</h1>'
D.dom`<h1>Hello World!</h1>`;
// => new instance of <HTMLHeadingElement>
D.dom`
<a href="/">Home</a>
<a href="/about">About</a>
`;
// => new instance of <NodeList> containing 2 links
// String
const headingText = 'Houses';
// Object
const headingAttrs = { class: 'heading-main' };
// Array
const names = ['Lannister', 'Stark', 'Tyrell'];
// Element
const backLink = document.querySelector('.js-link-back');
D.html`
<div>
<h1 ${headingAttrs}>${headingText}</h1>
<ul>
${names.map(names => D.html`<li>${name}</li>`)}
</ul>
${backLink}
</div>
`;
// =>
// <div>
// <h1 class="heading-main">Houses</h1>
// <ul>
// <li>Lannister</li><li>Stark</li><li>Tyrell</li>
// </ul>
// <a class="js-link-back" href="/">Back to home</a>
// </div>
Note that the list of names required D.html
to be used on the inner template literal. Without this, the HTML in the list would have been escaped:
"<li>Lannister</li><li>Stark</li><li>Tyrell</li>"
All strings that are interpolated are escaped in this way. To dangerously escape a variable that is not defined via a template literal, use the D
constructor:
const title = someExternalFunctionForGettingTitle();
D.dom`<h1>${new D(title)}</h1>`;
FAQs
Template literal tags for creating DOM nodes.
The npm package domm receives a total of 1 weekly downloads. As such, domm popularity was classified as not popular.
We found that domm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.