
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
htmlparser2-media
Advanced tools
Supply Chain Security
Vulnerability
Quality
Maintenance
License
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Unpopular package
QualityThis package is not very popular.
Found 1 instance in 1 package
Socket optimized override available
#htmlparser2
A forgiving HTML/XML/RSS parser written in JS for NodeJS. The parser can handle streams (chunked data) and supports custom handlers for writing custom DOMs/output.
##Installing npm install htmlparser2
A live demo of htmlparser2 is available at http://demos.forbeslindesay.co.uk/htmlparser2/
##Usage
var htmlparser = require("htmlparser2");
var parser = new htmlparser.Parser({
onopentag: function(name, attribs){
if(name === "script" && attribs.type === "text/javascript"){
console.log("JS! Hooray!");
}
},
ontext: function(text){
console.log("-->", text);
},
onclosetag: function(tagname){
if(tagname === "script"){
console.log("That's it?!");
}
}
});
parser.write("Xyz <script type='text/javascript'>var foo = '<<bar>>';</ script>");
parser.end();
Output (simplified):
--> Xyz
JS! Hooray!
--> var foo = '<<bar>>';
That's it?!
Read more about the parser in the wiki.
##Get a DOM
The DomHandler
(known as DefaultHandler
in the original htmlparser
module) produces a DOM (document object model) that can be manipulated using the DomUtils
helper.
The DomHandler
, while still bundled with this module, was moved to its own module. Have a look at it for further information.
##Parsing RSS/RDF/Atom Feeds
new htmlparser.FeedHandler(function(<error> error, <object> feed){
...
});
##Performance
After having some artificial benchmarks for some time, @AndreasMadsen published his htmlparser-benchmark
, which benchmarks HTML parses based on real-world websites.
At the time of writing, the latest versions of all supported parsers show the following performance characteristics on Travis CI (please note that Travis doesn't guarantee equal conditions for all tests):
gumbo-parser : 34.9208 ms/file ± 21.4238
html-parser : 24.8224 ms/file ± 15.8703
html5 : 419.597 ms/file ± 264.265
htmlparser : 60.0722 ms/file ± 384.844
htmlparser2-dom: 12.0749 ms/file ± 6.49474
htmlparser2 : 7.49130 ms/file ± 5.74368
hubbub : 30.4980 ms/file ± 16.4682
libxmljs : 14.1338 ms/file ± 18.6541
parse5 : 22.0439 ms/file ± 15.3743
sax : 49.6513 ms/file ± 26.6032
##How is this different from node-htmlparser?
This is a fork of the htmlparser
module. The main difference is that this is intended to be used only with node (it runs on other platforms using browserify). htmlparser2
was rewritten multiple times and, while it maintains an API that's compatible with htmlparser
in most cases, the projects don't share any code anymore.
The parser now provides a callback interface close to sax.js (originally targeted at readabilitySAX). As a result, old handlers won't work anymore.
The DefaultHandler
and the RssHandler
were renamed to clarify their purpose (to DomHandler
and FeedHandler
). The old names are still available when requiring htmlparser2
, so your code should work as expected.
FAQs
Fast & forgiving HTML/XML/RSS parser
The npm package htmlparser2-media receives a total of 660 weekly downloads. As such, htmlparser2-media popularity was classified as not popular.
We found that htmlparser2-media demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.