
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
hast-util-find-and-replace
Advanced tools
hast utility to find and replace things.
This package is a utility that lets you find patterns (string
, RegExp
) in
text and replace them with nodes (such as elements).
It’s aware of HTML (such as ignoring <style>
and <script>
by default).
This utility is typically useful when you have regexes and want to modify hast.
One example is when you have some form of “mentions” (such as
/@([a-z][_a-z0-9])\b/gi
) and want to create links to persons from them.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install hast-util-find-and-replace
In Deno with esm.sh
:
import {findAndReplace} from 'https://esm.sh/hast-util-find-and-replace@5'
In browsers with esm.sh
:
<script type="module">
import {findAndReplace} from 'https://esm.sh/hast-util-find-and-replace@5?bundle'
</script>
import {h} from 'hastscript'
import {findAndReplace} from 'hast-util-find-and-replace'
import {inspect} from 'unist-util-inspect'
const tree = h('p', [
'Some ',
h('em', 'emphasis'),
', ',
h('strong', 'importance'),
', and ',
h('code', 'code'),
'.'
])
findAndReplace(tree, [
[/and/gi, 'or'],
[/emphasis/gi, 'em'],
[/importance/gi, 'strong'],
[
/code/gi,
function ($0) {
return h('a', {href: '//example.com#' + $0}, $0)
}
]
])
console.log(inspect(tree))
Yields:
element<p>[9]
│ properties: {}
├─0 text "Some "
├─1 element<em>[1]
│ │ properties: {}
│ └─0 text "em"
├─2 text ", "
├─3 element<strong>[1]
│ │ properties: {}
│ └─0 text "strong"
├─4 text ", "
├─5 text "or"
├─6 text " "
├─7 element<code>[1]
│ │ properties: {}
│ └─0 element<a>[1]
│ │ properties: {"href":"//example.com#code"}
│ └─0 text "code"
└─8 text "."
This package exports the identifiers defaultIgnore
and
findAndReplace
.
There is no default export.
defaultIgnore
Default tag names to ignore (Array<string>
).
The defaults are math
, script
, style
, svg
, and title
.
findAndReplace(tree, list[, options])
Find patterns in a tree and replace them.
The algorithm searches the tree in preorder for complete values in
Text
nodes.
Partial matches are not supported.
tree
(Node
)
— tree to changelist
(FindAndReplaceList
or
FindAndReplaceTuple
)
— one or more find-and-replace pairsoptions
(Options
)
— configurationNothing (undefined
).
Find
Pattern to find (TypeScript type).
Strings are escaped and then turned into global expressions.
type Find = RegExp | string
FindAndReplaceList
Several find and replaces, in array form (TypeScript type).
type FindAndReplaceList = Array<FindAndReplaceTuple>
See FindAndReplaceTuple
.
FindAndReplaceTuple
Find and replace in tuple form (TypeScript type).
type FindAndReplaceTuple = [Find, Replace?]
Options
Configuration (TypeScript type).
ignore
(Test
, optional)
— test for which elements to ignoreRegExpMatchObject
Info on the match (TypeScript type).
index
(number
)
— the index of the search at which the result was foundinput
(string
)
— a copy of the search string in the text nodestack
(Array<Node>
)
— all ancestors of the text node, where the last node is the text itselfReplace
Thing to replace with (TypeScript type).
type Replace = ReplaceFunction | string | null | undefined
See ReplaceFunction
.
ReplaceFunction
Callback called when a search matches (TypeScript type).
The parameters are the result of corresponding search expression:
value
(string
)
— whole match...capture
(Array<string>
)
— matches from regex capture groupsmatch
(RegExpMatchObject
)
— info on the matchThing to replace with:
null
, undefined
, ''
, remove the matchfalse
, do not replace at allstring
, replace with a text node of that valueArray<Node>
or Node
, replace with those nodesThis package is fully typed with TypeScript.
It exports the additional types Find
,
FindAndReplaceList
,
FindAndReplaceTuple
,
Options
,
RegExpMatchObject
,
Replace
, and
ReplaceFunction
.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line,
hast-util-find-and-replace@^5
, compatible with Node.js 16.
Use of hast-util-find-and-replace
can open you up to a
cross-site scripting (XSS) attack if a value used to replace
is unsafe.
Use hast-util-santize
to make the hast tree safe.
The following example shows how a script is injected that runs when loaded in a browser.
const tree = h('p', 'This and that.')
findAndReplace(tree, 'and', function () {
return h('script', 'alert(1)')
})
Yields:
<p>This <script>alert(1)</script> that.</p>
hast-util-select
— querySelector
, querySelectorAll
, and matches
mdast-util-find-and-replace
— find and replace in mdastunist-util-select
— select unist nodes with CSS-like selectorsSee contributing.md
in syntax-tree/.github
for
ways to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organisation, or community you agree to abide by its terms.
FAQs
hast utility to find and replace text in a tree
The npm package hast-util-find-and-replace receives a total of 0 weekly downloads. As such, hast-util-find-and-replace popularity was classified as not popular.
We found that hast-util-find-and-replace demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.