Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
html-react-parser
Advanced tools
The html-react-parser package is designed to convert HTML strings into React components. This is particularly useful when you need to dynamically render HTML content in a React application, such as content fetched from a CMS or API that returns HTML. It allows for custom handling of elements, attributes, and can work with server-side rendering.
Parsing HTML strings to React Elements
This feature allows you to convert a string of HTML into React elements that can be rendered inside a React component.
import parse from 'html-react-parser';
const html = '<div>Hello World</div>';
const reactElement = parse(html);
Replacing or modifying elements during parsing
This feature allows you to define a 'replace' function in the options object that can modify or replace elements during the parsing process.
import parse, { domToReact } from 'html-react-parser';
const html = '<p id="replace">Replace me</p>';
const options = {
replace: ({ attribs, children }) => {
if (attribs && attribs.id === 'replace') {
return <span>{domToReact(children)}</span>;
}
}
};
const reactElement = parse(html, options);
Preserving custom attributes and event handlers
This feature allows you to preserve custom attributes and potentially event handlers when parsing HTML to React elements.
import parse from 'html-react-parser';
const html = '<div onclick="handleClick()">Click me</div>';
const reactElement = parse(html, {
preserveAttributes: ['onclick']
});
react-html-parser is similar to html-react-parser in that it converts HTML strings into React components. However, it may differ in the specifics of its API and the options it provides for customization during the parsing process.
dangerously-set-html-content provides a component that can be used to set raw HTML content. It is similar to using the dangerouslySetInnerHTML prop in React but encapsulated in a component for easier use. It does not offer the same level of customization or parsing capabilities as html-react-parser.
sanitize-html-react is designed to sanitize HTML strings before they are rendered to prevent XSS attacks. It can be used in conjunction with html-react-parser to first sanitize the HTML string and then parse it into React components. It focuses more on security rather than parsing.
An HTML to React parser:
Parser(htmlString[, options])
The parser converts a string of HTML to React Element(s).
There is also an option to replace element(s) with your own React Element(s) via the parser options.
var Parser = require('html-react-parser');
Parser('<p>Hello, world!</p>');
// same output as `React.createElement('p', {}, 'Hello, world!')`
NPM:
$ npm install html-react-parser
Or if you're using react <15.4:
$ npm install html-react-parser@0.2
CDN:
<!-- HTMLReactParser depends on React -->
<script src="https://unpkg.com/react@latest/dist/react.min.js"></script>
<script src="https://unpkg.com/html-react-parser@latest/dist/html-react-parser.min.js"></script>
See more examples.
Given that you have the following required:
// ES6
import Parser from 'html-react-parser';
import { render } from 'react-dom';
You may render one element:
render(
Parser('<p>single</p>'),
document.getElementById('root')
);
You may render adjacent elements:
// with JSX
render(
// the parser returns an array for adjacent elements
// so make sure they are nested under a parent React element
<div>
{Parser('<p>brother</p><p>sister</p>')}
</div>,
document.getElementById('root')
);
// without JSX
render(
React.createElement('div', {},
Parser('<p>brother</p><p>sister</p>')
),
document.getElementById('root')
);
You may render nested elements:
render(
Parser('<ul><li>inside</li></ul>'),
document.getElementById('root')
);
The parser will also preserve attributes:
render(
Parser('<section id="foo" class="bar baz" data-qux="42">look at me now</section>'),
document.getElementById('root')
);
The replace
method allows you to swap an element with your own React Element.
The first argument is domNode
, which is an object that has the same output as htmlparser2.parseDOM.
The element is only replaced if a valid React Element is returned.
// with JSX
Parser('<p id="replace">text</p>', {
replace: function(domNode) {
if (domNode.attribs && domNode.attribs.id === 'replace') {
return <span>replaced</span>;
}
}
});
Advanced example (keep the replaced children):
// with ES6 and JSX
// converts dom object to React Elements
import domToReact from 'html-react-parser/lib/dom-to-react';
const html = `
<div>
<p id="main">
<span class="prettify">
keep me and make me pretty!
</span>
</p>
</div>
`;
// parser config
const options = {
replace: (domNode) => {
// do not replace if element has no attributes
if (!domNode.attribs) return;
if (domNode.attribs.id === 'main') {
return (
<span style={{ fontSize: '42px' }}>
{domToReact(domNode.children, options)}
</span>
);
} else if (domNode.attribs.class === 'prettify') {
return (
<span style={{ color: 'hotpink' }}>
{domToReact(domNode.children, options)}
</span>
);
}
}
};
render(
Parser(html, options),
document.getElementById('root')
);
You will get the following:
<div>
<span style="font-size: 42px;">
<span class="prettify" style="color: hotpink;">
keep me and make me pretty!
</span>
</span>
</div>
$ npm test
$ npm run lint
0.2.0 (2016-11-18)
clean
that removes dist/
directoryFAQs
HTML to React parser.
The npm package html-react-parser receives a total of 1,567,712 weekly downloads. As such, html-react-parser popularity was classified as popular.
We found that html-react-parser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.