Security News
Fluent Assertions Faces Backlash After Abandoning Open Source Licensing
Fluent Assertions is facing backlash after dropping the Apache license for a commercial model, leaving users blindsided and questioning contributor rights.
hast-util-find-and-replace
Advanced tools
hast utility to find and replace things.
This package is a utility that lets you find patterns (string
, RegExp
) in
text and replace them with nodes (such as elements).
It’s aware of HTML (such as ignoring <style>
and <script>
by default).
This utility is typically useful when you have regexes and want to modify hast.
One example is when you have some form of “mentions” (such as
/@([a-z][_a-z0-9])\b/gi
) and want to create links to persons from them.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install hast-util-find-and-replace
In Deno with esm.sh
:
import {findAndReplace} from 'https://esm.sh/hast-util-find-and-replace@5'
In browsers with esm.sh
:
<script type="module">
import {findAndReplace} from 'https://esm.sh/hast-util-find-and-replace@5?bundle'
</script>
import {h} from 'hastscript'
import {findAndReplace} from 'hast-util-find-and-replace'
import {inspect} from 'unist-util-inspect'
const tree = h('p', [
'Some ',
h('em', 'emphasis'),
', ',
h('strong', 'importance'),
', and ',
h('code', 'code'),
'.'
])
findAndReplace(tree, [
[/and/gi, 'or'],
[/emphasis/gi, 'em'],
[/importance/gi, 'strong'],
[
/code/gi,
function ($0) {
return h('a', {href: '//example.com#' + $0}, $0)
}
]
])
console.log(inspect(tree))
Yields:
element<p>[9]
│ properties: {}
├─0 text "Some "
├─1 element<em>[1]
│ │ properties: {}
│ └─0 text "em"
├─2 text ", "
├─3 element<strong>[1]
│ │ properties: {}
│ └─0 text "strong"
├─4 text ", "
├─5 text "or"
├─6 text " "
├─7 element<code>[1]
│ │ properties: {}
│ └─0 element<a>[1]
│ │ properties: {"href":"//example.com#code"}
│ └─0 text "code"
└─8 text "."
This package exports the identifiers defaultIgnore
and
findAndReplace
.
There is no default export.
defaultIgnore
Default tag names to ignore (Array<string>
).
The defaults are math
, script
, style
, svg
, and title
.
findAndReplace(tree, list[, options])
Find patterns in a tree and replace them.
The algorithm searches the tree in preorder for complete values in
Text
nodes.
Partial matches are not supported.
tree
(Node
)
— tree to changelist
(FindAndReplaceList
or
FindAndReplaceTuple
)
— one or more find-and-replace pairsoptions
(Options
)
— configurationNothing (undefined
).
Find
Pattern to find (TypeScript type).
Strings are escaped and then turned into global expressions.
type Find = RegExp | string
FindAndReplaceList
Several find and replaces, in array form (TypeScript type).
type FindAndReplaceList = Array<FindAndReplaceTuple>
See FindAndReplaceTuple
.
FindAndReplaceTuple
Find and replace in tuple form (TypeScript type).
type FindAndReplaceTuple = [Find, Replace?]
Options
Configuration (TypeScript type).
ignore
(Test
, optional)
— test for which elements to ignoreRegExpMatchObject
Info on the match (TypeScript type).
index
(number
)
— the index of the search at which the result was foundinput
(string
)
— a copy of the search string in the text nodestack
(Array<Node>
)
— all ancestors of the text node, where the last node is the text itselfReplace
Thing to replace with (TypeScript type).
type Replace = ReplaceFunction | string | null | undefined
See ReplaceFunction
.
ReplaceFunction
Callback called when a search matches (TypeScript type).
The parameters are the result of corresponding search expression:
value
(string
)
— whole match...capture
(Array<string>
)
— matches from regex capture groupsmatch
(RegExpMatchObject
)
— info on the matchThing to replace with:
null
, undefined
, ''
, remove the matchfalse
, do not replace at allstring
, replace with a text node of that valueArray<Node>
or Node
, replace with those nodesThis package is fully typed with TypeScript.
It exports the additional types Find
,
FindAndReplaceList
,
FindAndReplaceTuple
,
Options
,
RegExpMatchObject
,
Replace
, and
ReplaceFunction
.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line,
hast-util-find-and-replace@^5
, compatible with Node.js 16.
Use of hast-util-find-and-replace
can open you up to a
cross-site scripting (XSS) attack if a value used to replace
is unsafe.
Use hast-util-santize
to make the hast tree safe.
The following example shows how a script is injected that runs when loaded in a browser.
const tree = h('p', 'This and that.')
findAndReplace(tree, 'and', function () {
return h('script', 'alert(1)')
})
Yields:
<p>This <script>alert(1)</script> that.</p>
hast-util-select
— querySelector
, querySelectorAll
, and matches
mdast-util-find-and-replace
— find and replace in mdastunist-util-select
— select unist nodes with CSS-like selectorsSee contributing.md
in syntax-tree/.github
for
ways to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organisation, or community you agree to abide by its terms.
FAQs
hast utility to find and replace text in a tree
The npm package hast-util-find-and-replace receives a total of 38,935 weekly downloads. As such, hast-util-find-and-replace popularity was classified as popular.
We found that hast-util-find-and-replace demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Fluent Assertions is facing backlash after dropping the Apache license for a commercial model, leaving users blindsided and questioning contributor rights.
Research
Security News
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
Security News
The UK is proposing a bold ban on ransomware payments by public entities to disrupt cybercrime, protect critical services, and lead global cybersecurity efforts.