Security News
Opengrep Emerges as Open Source Alternative Amid Semgrep Licensing Controversy
Opengrep forks Semgrep to preserve open source SAST in response to controversial licensing changes.
html-react-parser
Advanced tools
The html-react-parser package is designed to convert HTML strings into React components. This is particularly useful when you need to dynamically render HTML content in a React application, such as content fetched from a CMS or API that returns HTML. It allows for custom handling of elements, attributes, and can work with server-side rendering.
Parsing HTML strings to React Elements
This feature allows you to convert a string of HTML into React elements that can be rendered inside a React component.
import parse from 'html-react-parser';
const html = '<div>Hello World</div>';
const reactElement = parse(html);
Replacing or modifying elements during parsing
This feature allows you to define a 'replace' function in the options object that can modify or replace elements during the parsing process.
import parse, { domToReact } from 'html-react-parser';
const html = '<p id="replace">Replace me</p>';
const options = {
replace: ({ attribs, children }) => {
if (attribs && attribs.id === 'replace') {
return <span>{domToReact(children)}</span>;
}
}
};
const reactElement = parse(html, options);
Preserving custom attributes and event handlers
This feature allows you to preserve custom attributes and potentially event handlers when parsing HTML to React elements.
import parse from 'html-react-parser';
const html = '<div onclick="handleClick()">Click me</div>';
const reactElement = parse(html, {
preserveAttributes: ['onclick']
});
react-html-parser is similar to html-react-parser in that it converts HTML strings into React components. However, it may differ in the specifics of its API and the options it provides for customization during the parsing process.
dangerously-set-html-content provides a component that can be used to set raw HTML content. It is similar to using the dangerouslySetInnerHTML prop in React but encapsulated in a component for easier use. It does not offer the same level of customization or parsing capabilities as html-react-parser.
sanitize-html-react is designed to sanitize HTML strings before they are rendered to prevent XSS attacks. It can be used in conjunction with html-react-parser to first sanitize the HTML string and then parse it into React components. It focuses more on security rather than parsing.
An HTML to React parser that works on both the server and the browser:
HTMLReactParser(string[, options])
The parser converts an HTML string to React element(s). If you want to replace an element with your own custom element, there's an option to do that.
Example:
var parse = require('html-react-parser');
parse('<div>text</div>'); // equivalent to `React.createElement('div', {}, 'text')`
CodeSandbox | JSFiddle | repl.it
NPM:
$ npm install html-react-parser --save
Yarn:
$ yarn add html-react-parser
unpkg (CDN):
<!-- HTMLReactParser depends on React -->
<script src="https://unpkg.com/react@16/umd/react.production.min.js"></script>
<script src="https://unpkg.com/html-react-parser@latest/dist/html-react-parser.min.js"></script>
<script>
window.HTMLReactParser(/* string */);
</script>
Given html-react-parser
is imported:
// ES Modules
import parse from 'html-react-parser';
Parse single element:
parse('<h1>single</h1>');
Parse multiple elements:
parse('<p>sibling 1</p><p>sibling 2</p>');
Because the parser returns an array for adjacent elements, make sure it's nested under a parent element when rendered:
import React, { Component } from 'react';
import parse from 'html-react-parser';
class App extends Component {
render() {
return <div>{parse('<p>sibling 1</p><p>sibling 2</p>')}</div>;
}
}
Parse nested elements:
parse('<ul><li>item</li></ul>');
Parse element with attributes:
parse(
'<hr id="foo" class="bar" data-attr="baz" custom="qux" style="top:42px;">'
);
The replace
method allows you to swap an element with your own React element.
The first argument is domNode
―an object with the same output as htmlparser2's domhandler.
The element is replaced only if a valid React element is returned.
parse('<p id="replace">text</p>', {
replace: function(domNode) {
if (domNode.attribs && domNode.attribs.id === 'replace') {
return React.createElement('span', {}, 'replaced');
}
}
});
The following example uses replace
to modify the children:
import React from 'react';
import { renderToStaticMarkup } from 'react-dom/server';
import parse, { domToReact } from 'html-react-parser';
const html = `
<p id="main">
<span class="prettify">
keep me and make me pretty!
</span>
</p>
`;
const options = {
replace: ({ attribs, children }) => {
if (!attribs) return;
if (attribs.id === 'main') {
return (
<h1 style={{ fontSize: 42 }}>{domToReact(children, parserOptions)}</h1>
);
} else if (attribs.class === 'prettify') {
return (
<span style={{ color: 'hotpink' }}>
{domToReact(children, parserOptions)}
</span>
);
}
}
};
const reactElement = parse(html, options);
console.log(renderToStaticMarkup(reactElement));
The output:
<h1 style="font-size:42px">
<span style="color:hotpink">
keep me and make me pretty!
</span>
</h1>
The following example uses replace
to exclude an element:
parse('<p><br id="remove"></p>', {
replace: ({ attribs }) =>
attribs && attribs.id === 'remove' && <React.Fragment />
});
No, this library does not sanitize against XSS (Cross-Site Scripting). See #94.
<script>
tags parsed?Although <script>
tags are parsed, react-dom does not render the contents. See #98.
That's because inline event handlers like onclick
are parsed as a string rather than a function. See #73.
$ npm test
$ npm run lint # npm run lint:fix
$ npm run test:benchmark
Here's an example output of the benchmarks run on a MacBook Pro 2017:
html-to-react - Single x 415,186 ops/sec ±0.92% (85 runs sampled)
html-to-react - Multiple x 139,780 ops/sec ±2.32% (87 runs sampled)
html-to-react - Complex x 8,118 ops/sec ±2.99% (82 runs sampled)
Only collaborators with credentials can release and publish:
$ npm run release
$ git push --follow-tags && npm publish
FAQs
HTML to React parser.
We found that html-react-parser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Opengrep forks Semgrep to preserve open source SAST in response to controversial licensing changes.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.