Security News
JSR Working Group Kicks Off with Ambitious Roadmap and Plans for Open Governance
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.
mdast-zone
Advanced tools
mdast utility to find two comments and replace the content in them.
This package is a utility that lets you find certain comments, then takes the content between them, and calls a given handler with the result, so that you can change or replace things.
This utility is typically useful when you have certain sections that can be generated. Comments are a hidden part of markdown, so they can be used as processing instructions. You can use those comments to define what content to change or replace.
A similar package, mdast-util-heading-range
, does
the same but uses a heading to mark the start and end of sections.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install mdast-zone
In Deno with esm.sh
:
import {zone} from 'https://esm.sh/mdast-zone@6'
In browsers with esm.sh
:
<script type="module">
import {zone} from 'https://esm.sh/mdast-zone@6?bundle'
</script>
Say we have the following file, example.md
:
<!--foo start-->
Foo
<!--foo end-->
…and a module example.js
:
import {zone} from 'mdast-zone'
import {remark} from 'remark'
import {read} from 'to-vfile'
const file = await remark()
.use(myPluginThatReplacesFoo)
.process(await read('example.md'))
console.log(String(file))
/** @type {import('unified').Plugin<[], import('mdast').Root>} */
function myPluginThatReplacesFoo() {
return function (tree) {
zone(tree, 'foo', function (start, nodes, end) {
return [
start,
{type: 'paragraph', children: [{type: 'text', value: 'Bar.'}]},
end
]
})
}
}
…now running node example.js
yields:
<!--foo start-->
Bar.
<!--foo end-->
This package exports the identifier zone
.
There is no default export.
zone(tree, name, handler)
Search tree
for a start and end comments matching name
and change their
“section” with handler
.
tree
(Node
)
— tree to changename
(string
)
— comment name to look forhandler
(Handler
)
— handle a sectionNothing (undefined
).
Handler
Callback called when a section is found (TypeScript type).
start
(Node
)
— start of sectionnodes
(Array<Node>
)
— nodes between start
and end
end
(Node
)
— end of sectioninfo
(Info
)
— extra infoResults (Array<Node | null | undefined>
, optional).
If nothing is returned, nothing will be changed.
If an array of nodes (can include null
and undefined
) is returned, the
original section will be replaced by those nodes.
Info
Extra info (TypeScript type).
parent
(Node
)
— parent of the sectionstart
(number
)
— index of start
in parent
end
(number
)
— index of end
in parent
This package is fully typed with TypeScript.
It exports the additional types Handler
and
Info
.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, mdast-zone@^6
,
compatible with Node.js 16.
Improper use of handler
can open you up to a cross-site scripting (XSS)
attack as the value it returns is injected into the syntax tree.
This can become a problem if the tree is later transformed to hast.
The following example shows how a script is injected that could run when loaded
in a browser.
function handler(start, nodes, end) {
return [start, {type: 'html', value: '<script>alert(1)</script>'}, end]
}
Yields:
<!--foo start-->
<script>alert(1)</script>
<!--foo end-->
Either do not use user input or use hast-util-santize
.
mdast-util-heading-range
— similar but uses headings to mark sectionsSee contributing.md
in syntax-tree/.github
for
ways to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
mdast utility to treat HTML comments as ranges or markers
We found that mdast-zone demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.
Security News
Research
An advanced npm supply chain attack is leveraging Ethereum smart contracts for decentralized, persistent malware control, evading traditional defenses.
Security News
Research
Attackers are impersonating Sindre Sorhus on npm with a fake 'chalk-node' package containing a malicious backdoor to compromise developers' projects.