Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
hast-util-from-parse5
Advanced tools
The `hast-util-from-parse5` package is a utility that converts a Parse5 AST (Abstract Syntax Tree) to a HAST (Hypertext Abstract Syntax Tree). This is particularly useful for working with HTML in a structured way, allowing for transformations, analysis, and manipulation of HTML content.
Convert Parse5 AST to HAST
This feature allows you to convert a Parse5 AST to a HAST. The code sample demonstrates parsing an HTML string into a Parse5 AST and then converting it to a HAST.
const parse5 = require('parse5');
const fromParse5 = require('hast-util-from-parse5');
const html = '<!doctype html><html><head><title>Example</title></head><body><p>Hello, world!</p></body></html>';
const parse5Ast = parse5.parse(html);
const hast = fromParse5(parse5Ast);
console.log(JSON.stringify(hast, null, 2));
Convert Parse5 Fragment to HAST
This feature allows you to convert a Parse5 fragment to a HAST. The code sample demonstrates parsing an HTML fragment into a Parse5 fragment and then converting it to a HAST.
const parse5 = require('parse5');
const fromParse5 = require('hast-util-from-parse5');
const htmlFragment = '<p>Hello, world!</p>';
const parse5Fragment = parse5.parseFragment(htmlFragment);
const hastFragment = fromParse5(parse5Fragment);
console.log(JSON.stringify(hastFragment, null, 2));
The `rehype-parse` package is a utility that parses HTML into a HAST directly, without needing an intermediate Parse5 AST. It is part of the unified collective and is often used in conjunction with other rehype plugins for processing HTML.
The `htmlparser2` package is a fast and forgiving HTML/XML parser. It can be used to parse HTML into a DOM-like structure, which can then be manipulated or converted to other formats. While it does not directly convert to HAST, it provides a similar parsing capability.
The `parse5` package is a comprehensive HTML parsing library that produces a Parse5 AST. While it does not convert to HAST directly, it is often used in conjunction with `hast-util-from-parse5` to achieve this conversion.
hast utility to transform from parse5
s AST.
This package is a utility that can turn a parse5 tree into a hast tree.
You can use this package when using parse5
as an HTML parser and wanting to
work with hast.
The utility hast-util-to-parse5
does the inverse of
this utility.
It generates parse5
s AST again.
The utility hast-util-from-html
wraps this utility and
parse5
to both parse HTML and generate hast from it.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install hast-util-from-parse5
In Deno with esm.sh
:
import {fromParse5} from "https://esm.sh/hast-util-from-parse5@8"
In browsers with esm.sh
:
<script type="module">
import {fromParse5} from "https://esm.sh/hast-util-from-parse5@8?bundle"
</script>
Say our document example.html
contains:
<!doctype html><title>Hello!</title><h1 id="world">World!<!--after-->
…and our module example.js
looks as follows:
import {fromParse5} from 'hast-util-from-parse5'
import {parse} from 'parse5'
import {read} from 'to-vfile'
import {inspect} from 'unist-util-inspect'
const file = await read('example.html')
const p5ast = parse(String(file), {sourceCodeLocationInfo: true})
const hast = fromParse5(p5ast, {file})
console.log(inspect(hast))
…now running node example.js
yields:
root[2] (1:1-2:1, 0-70)
│ data: {"quirksMode":false}
├─0 doctype (1:1-1:16, 0-15)
└─1 element<html>[2]
│ properties: {}
├─0 element<head>[1]
│ │ properties: {}
│ └─0 element<title>[1] (1:16-1:37, 15-36)
│ │ properties: {}
│ └─0 text "Hello!" (1:23-1:29, 22-28)
└─1 element<body>[1]
│ properties: {}
└─0 element<h1>[3] (1:37-2:1, 36-70)
│ properties: {"id":"world"}
├─0 text "World!" (1:52-1:58, 51-57)
├─1 comment "after" (1:58-1:70, 57-69)
└─2 text "\n" (1:70-2:1, 69-70)
This package exports the identifier fromParse5
.
There is no default export.
fromParse5(tree[, options])
Transform a parse5
AST to hast.
tree
(Parse5Node
)
— parse5
tree to transformoptions
(Options
, optional)
— configurationhast tree (HastNode
).
Options
Configuration (TypeScript type).
file
File used to add positional info to nodes (VFile
, optional).
If given, the file should represent the original HTML source.
space
Which space the document is in (Space
, default: 'html'
).
When an <svg>
element is found in the HTML space, this package already
automatically switches to and from the SVG space when entering and exiting
it.
verbose
Whether to add extra positional info about starting tags, closing tags,
and attributes to elements (boolean
, default: false
).
👉 Note: only used when
file
is given.
For the following HTML:
<img src="http://example.com/fav.ico" alt="foo" title="bar">
The verbose info would looks as follows:
{
type: 'element',
tagName: 'img',
properties: {src: 'http://example.com/fav.ico', alt: 'foo', title: 'bar'},
children: [],
data: {
position: {
opening: {
start: {line: 1, column: 1, offset: 0},
end: {line: 1, column: 61, offset: 60}
},
closing: null,
properties: {
src: {
start: {line: 1, column: 6, offset: 5},
end: {line: 1, column: 38, offset: 37}
},
alt: {
start: {line: 1, column: 39, offset: 38},
end: {line: 1, column: 48, offset: 47}
},
title: {
start: {line: 1, column: 49, offset: 48},
end: {line: 1, column: 60, offset: 59}
}
}
}
},
position: {
start: {line: 1, column: 1, offset: 0},
end: {line: 1, column: 61, offset: 60}
}
}
Space
Namespace (TypeScript type).
type Space = 'html' | 'svg'
This package is fully typed with TypeScript.
It exports the additional types Options
and
Space
.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, hast-util-from-parse5@^8
,
compatible with Node.js 16.
Use of hast-util-from-parse5
can open you up to a
cross-site scripting (XSS) attack if Parse5’s AST is unsafe.
hast-util-to-parse5
— transform hast to Parse5’s ASThast-util-to-nlcst
— transform hast to nlcsthast-util-to-mdast
— transform hast to mdasthast-util-to-xast
— transform hast to xastmdast-util-to-hast
— transform mdast to hastmdast-util-to-nlcst
— transform mdast to nlcstSee contributing.md
in syntax-tree/.github
for
ways to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
hast utility to transform from a `parse5` AST
The npm package hast-util-from-parse5 receives a total of 3,040,799 weekly downloads. As such, hast-util-from-parse5 popularity was classified as popular.
We found that hast-util-from-parse5 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.