Security News
JavaScript Leaders Demand Oracle Release the JavaScript Trademark
In an open letter, JavaScript community leaders urge Oracle to give up the JavaScript trademark, arguing that it has been effectively abandoned through nonuse.
hast-util-raw
Advanced tools
The hast-util-raw package is a utility for working with HAST (Hypertext Abstract Syntax Tree) trees. It can parse and transform raw HTML into a HAST tree, allowing for manipulation and analysis of the structure of HTML documents. This package is particularly useful for developers working with virtual DOMs or needing to preprocess or clean HTML content programmatically.
Parsing HTML to HAST
This feature allows for the parsing of HTML strings embedded within HAST trees. The `raw` function takes a HAST tree that may contain raw HTML as part of its nodes and returns a new HAST tree with the raw HTML parsed into HAST nodes. This is useful for integrating unescaped HTML strings into a HAST-based workflow.
const raw = require('hast-util-raw');
const h = require('hastscript');
const tree = h('div', [h('span', 'Hello'), '<strong>world!</strong>']);
const result = raw(tree);
Transforming HAST with embedded raw HTML
This demonstrates how `hast-util-raw` can transform a HAST tree that includes a 'raw' node containing HTML into a fully parsed HAST structure. This is particularly useful for scenarios where raw HTML is mixed with HAST content and a uniform HAST structure is needed for further processing.
const raw = require('hast-util-raw');
const u = require('unist-builder');
const tree = u('root', [u('element', {tagName: 'div'}, [u('text', 'Some text'), u('raw', '<span>More text</span>')])]);
const result = raw(tree);
Similar to hast-util-raw, `rehype-parse` is used for parsing HTML into HAST. However, `rehype-parse` is more focused on being a full HTML parser as part of the rehype ecosystem, offering more comprehensive parsing options and better integration with rehype plugins.
hast utility to parse the tree and semistandard raw
nodes (strings of
HTML) again, keeping positional info okay.
This package is a utility to parse a document again.
It passes each node and embedded raw HTML through an HTML parser
(parse5
), to recreate a tree exactly as how a browser would parse
it, while keeping the original data and positional info intact.
This utility is particularly useful when coming from markdown and wanting to
support HTML embedded inside that markdown (which requires passing
allowDangerousHtml: true
to mdast-util-to-hast
).
Markdown dictates how, say, a list item or emphasis can be parsed.
We can use that to turn the markdown syntax tree into an HTML syntax tree.
But markdown also dictates that things that look like HTML, are passed through
untouched, even when it just looks like XML but doesn’t really make sense, so we
can’t normally use these strings of “HTML” to create an HTML syntax tree.
This utility can.
It can be used to take those strings of HTML and include them into the syntax
tree as actual nodes.
If your final result is HTML and you trust content, then “strings” are fine
(you can pass allowDangerousHtml: true
to hast-util-to-html
, which passes
HTML through untouched).
But there are two main cases where a proper syntax tree is preferred:
The plugin rehype-raw
wraps this utility at a higher-level
(easier) abstraction.
This package is ESM only. In Node.js (version 12.20+, 14.14+, 16.0+, or 18.0+), install with npm:
npm install hast-util-raw
In Deno with esm.sh
:
import {raw} from 'https://esm.sh/hast-util-raw@7'
In browsers with esm.sh
:
<script type="module">
import {raw} from 'https://esm.sh/hast-util-raw@7?bundle'
</script>
import {h} from 'hastscript'
import {raw} from 'hast-util-raw'
const tree = h('div', [h('h1', ['Foo ', h('h2', 'Bar'), ' Baz'])])
const reformatted = raw(tree)
console.log(reformatted)
Yields:
{ type: 'element',
tagName: 'div',
properties: {},
children:
[ { type: 'element',
tagName: 'h1',
properties: {},
children: [Object] },
{ type: 'element',
tagName: 'h2',
properties: {},
children: [Object] },
{ type: 'text', value: ' Baz' } ] }
This package exports the identifier raw
.
There is no default export.
raw(tree[, file][, options])
Parse the tree and raw nodes (strings of HTML) again, keeping positional info okay.
👉 Note:
tree
should have positional info andfile
, when given, must be a vfile corresponding totree
.
options
Configuration (optional).
options.passThrough
List of custom hast node types to pass through (keep) in hast (Array<string>
,
default: []
).
If the passed through nodes have children, those children are expected to be
hast and will be handled by this utility.
This package is fully typed with TypeScript.
It exports the additional type Options
.
It also registers the Raw
node type with @types/hast
.
If you’re working with the syntax tree, make sure to import this utility
somewhere in your types, as that registers the new node types in the tree.
/**
* @typedef {import('hast-util-raw')}
*/
import {visit} from 'unist-util-visit'
/** @type {import('hast').Root} */
const tree = getHastNodeSomeHow()
visit(tree, (node) => {
// `node` can now be a `raw` node.
})
Projects maintained by the unified collective are compatible with all maintained versions of Node.js. As of now, that is Node.js 12.20+, 14.14+, 16.0+, and 18.0+. Our projects sometimes work with older versions, but this is not guaranteed.
Use of hast-util-raw
can open you up to a cross-site scripting (XSS)
attack as raw
nodes are unsafe.
The following example shows how a raw node is used to inject a script that runs
when loaded in a browser.
raw(u('root', [u('raw', '<script>alert(1)</script>')]))
Yields:
<script>alert(1)</script>
Either do not use this utility in combination with user input, or use
hast-util-santize
.
mdast-util-to-hast
— transform mdast to hastrehype-raw
— rehype pluginSee contributing.md
in syntax-tree/.github
for
ways to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
hast utility to reparse a tree
The npm package hast-util-raw receives a total of 2,776,314 weekly downloads. As such, hast-util-raw popularity was classified as popular.
We found that hast-util-raw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
In an open letter, JavaScript community leaders urge Oracle to give up the JavaScript trademark, arguing that it has been effectively abandoned through nonuse.
Security News
The initial version of the Socket Python SDK is now on PyPI, enabling developers to more easily interact with the Socket REST API in Python projects.
Security News
Floating dependency ranges in npm can introduce instability and security risks into your project by allowing unverified or incompatible versions to be installed automatically, leading to unpredictable behavior and potential conflicts.