Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

micromark-extension-gfm-tagfilter

Package Overview
Dependencies
Maintainers
1
Versions
7
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

micromark-extension-gfm-tagfilter

micromark extension to support GFM tagfilter

  • 2.0.0
  • latest
  • Source
  • npm
  • Socket score

Version published
Weekly downloads
3.6M
decreased by-11.16%
Maintainers
1
Weekly downloads
 
Created
Source

micromark-extension-gfm-tagfilter

Build Coverage Downloads Size Sponsors Backers Chat

micromark extension to support GFM tag filter.

Contents

What is this?

This package contains an extension that adds support for the tagfilter enabled by GFM to micromark. The tagfilter is kinda weird and kinda useless. This package exists for completeness. The tag filter is a naïve attempt at XSS protection. You should use a proper HTML sanitizing algorithm.

When to use this

This project is useful when you want to match how GitHub works. You can use this extension when you are working with micromark already. When you do, you can instead use micromark-extension-gfm, which includes this extension, to support all GFM features.

When you want to deal with syntax trees, you should instead use hast-util-sanitize.

When you use remark and rehype, you should use rehype-sanitize.

Install

This package is ESM only. In Node.js (version 16+), install with npm:

npm install micromark-extension-gfm-tagfilter

In Deno with esm.sh:

import {gfmTagfilterHtml} from 'https://esm.sh/micromark-extension-gfm-tagfilter@2'

In browsers with esm.sh:

<script type="module">
  import {gfmTagfilterHtml} from 'https://esm.sh/micromark-extension-gfm-tagfilter@2?bundle'
</script>

Use

import {micromark} from 'micromark'
import {gfmTagfilterHtml} from 'micromark-extension-gfm-tagfilter'

const output = micromark('XSS! <script>alert(1)</script>', {
  allowDangerousHtml: true,
  htmlExtensions: [gfmTagfilterHtml()]
})

console.log(output)

Yields:

<p>XSS! &lt;script>alert(1)&lt;/script></p>

API

This package exports the identifier gfmTagfilterHtml. There is no default export.

gfmTagfilterHtml()

Create an HTML extension for micromark to support GitHubs weird and useless tagfilter when serializing to HTML.

Returns

Extension for micromark that can be passed in htmlExtensions to support GitHubs weird and useless tagfilter when serializing to HTML (HtmlExtension).

Authoring

This package relates to malicious authors, not decent authors.

HTML

GFM tagfilter removes certain dangerous HTML tags: iframe, noembed, noframes, plaintext, script, style, title, textarea, and xmp.

CSS

This package does not relate to CSS.

Syntax

This package does not change how markdown is parsed.

Types

This package is fully typed with TypeScript. It exports no additional types.

Compatibility

Projects maintained by the unified collective are compatible with maintained versions of Node.js.

When we cut a new major release, we drop support for unmaintained versions of Node. This means we try to keep the current release line, micromark-extension-gfm-tagfilter@^2, compatible with Node.js 16.

This package works with micromark version 3 and later.

Security

While micromark is safe by default, this extension only does something when allowDangerousHtml: true is passed, which is an unsafe option. This package is not safe.

Contribute

See contributing.md in micromark/.github for ways to get started. See support.md for ways to get help.

This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.

License

MIT © Titus Wormer

Keywords

FAQs

Package last updated on 23 Jun 2023

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc