Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
posthtml-parser
Advanced tools
The posthtml-parser npm package is a tool used to parse HTML into an Abstract Syntax Tree (AST). This allows developers to manipulate HTML content programmatically, making it easier to perform tasks such as transforming HTML structures, extracting specific elements, and integrating with other tools in the PostHTML ecosystem.
Parsing HTML to AST
This feature allows you to parse a string of HTML into an Abstract Syntax Tree (AST). The AST can then be manipulated programmatically.
const parse = require('posthtml-parser');
const html = '<div class="example">Hello World</div>';
const ast = parse(html);
console.log(ast);
Handling HTML fragments
This feature allows you to parse HTML fragments and control parsing options such as whether to convert tag names to lowercase.
const parse = require('posthtml-parser');
const fragment = '<span>Fragment</span>';
const ast = parse(fragment, { lowerCaseTags: false });
console.log(ast);
Integration with PostHTML plugins
This feature demonstrates how to integrate the parser with PostHTML plugins to transform HTML content. In this example, a plugin is used to change all <div> tags to <section> tags.
const posthtml = require('posthtml');
const parse = require('posthtml-parser');
const html = '<div class="example">Hello World</div>';
posthtml()
.use(tree => {
tree.match({ tag: 'div' }, node => {
node.tag = 'section';
return node;
});
})
.process(html)
.then(result => console.log(result.html));
htmlparser2 is a fast and forgiving HTML/XML parser. It is similar to posthtml-parser in that it parses HTML into a tree structure, but it is more focused on speed and flexibility. It also supports streaming and can handle large documents efficiently.
parse5 is a highly compliant HTML parser that closely follows the WHATWG HTML specification. It is similar to posthtml-parser in its ability to parse HTML into an AST, but it is known for its strict adherence to web standards and comprehensive support for HTML5 features.
cheerio is a fast, flexible, and lean implementation of core jQuery designed specifically for the server. It parses HTML and XML into a DOM-like structure, allowing for jQuery-like manipulation of the document. While it offers similar parsing capabilities, it is more focused on providing a familiar API for DOM manipulation.
npm install posthtml-parser
Input HTML:
<a class="animals" href="#">
<span class="animals__cat" style="background: url(cat.png)">Cat</span>
</a>
Parse with posthtml-parser
:
import fs from 'fs'
import { parser } from 'posthtml-parser'
const html = fs.readFileSync('path/to/input.html', 'utf-8')
console.log(parser(html))
Resulting PostHTML AST:
[
{
tag: 'a',
attrs: {
class: 'animals',
href: '#'
},
content: [
'\n ',
{
tag: 'span',
attrs: {
class: 'animals__cat',
style: 'background: url(cat.png)'
},
content: ['Cat']
},
'\n'
]
}
]
Any parser used with PostHTML should return a standard PostHTML Abstract Syntax Tree (AST).
Fortunately, this is a very easy format to produce and understand. The AST is an array that can contain strings and objects. Strings represent plain text content, while objects represent HTML tags.
Tag objects generally look like this:
{
tag: 'div',
attrs: {
class: 'foo'
},
content: ['hello world!']
}
Tag objects can contain three keys:
tag
key takes the name of the tag as the value. This can include custom tags.attrs
key takes an object with key/value pairs representing the attributes of the html tag. A boolean attribute has an empty string as its value.content
key takes an array as its value, which is a PostHTML AST. In this manner, the AST is a tree that should be walked recursively.directives
Type: Array
Default: [{name: '!doctype', start: '<', end: '>'}]
Adds processing of custom directives.
The property name
in custom directives can be of String
or RegExp
type.
xmlMode
Type: Boolean
Default: false
Indicates whether special tags (<script>
and <style>
) should get special treatment and if "empty" tags (eg. <br>
) can have children. If false, the content of special tags will be text only.
For feeds and other XML content (documents that don't consist of HTML), set this to true
.
decodeEntities
Type: Boolean
Default: false
If set to true
, entities within the document will be decoded.
lowerCaseTags
Type: Boolean
Default: false
If set to true
, all tags will be lowercased. If xmlMode
is disabled.
lowerCaseAttributeNames
Type: Boolean
Default: false
If set to true
, all attribute names will be lowercased.
This has noticeable impact on speed.
recognizeCDATA
Type: Boolean
Default: false
If set to true
, CDATA sections will be recognized as text even if the xmlMode
option is not enabled.
If xmlMode
is set to true
, then CDATA sections will always be recognized as text.
recognizeSelfClosing
Type: Boolean
Default: false
If set to true
, self-closing tags will trigger the onclosetag
event even if xmlMode
is not set to true
.
If xmlMode
is set to true
, then self-closing tags will always be recognized.
sourceLocations
Type: Boolean
Default: false
If set to true
, AST nodes will have a location
property containing the start
and end
line and column position of the node.
recognizeNoValueAttribute
Type: Boolean
Default: false
If set to true
, AST nodes will recognize attribute with no value and mark as true
which will be correctly rendered by posthtml-render
package.
FAQs
Parse HTML/XML to PostHTMLTree
The npm package posthtml-parser receives a total of 864,467 weekly downloads. As such, posthtml-parser popularity was classified as popular.
We found that posthtml-parser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.