Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
This is a rework of Elie Rotenberg's react-ml library.
React-base, extensible user-facing language (think BBCode/WikiCode) for the modern web.
It allows you to enrich your user-generated content (comments, forum posts...) with custom, well-integrated features.
It compiles text written by your users to injection-safe JSX (React Elements) using rules defined by you.
<script>
, <iframe>
or <style>
, which you can)Using reaml-ml/app/presets/basic
, the following text:
<b>Hello</b>
<div>Mess with DOM</div>
<i>World</i><script>alert("I'm evil")</script>
<link>github.com</link>
<iframe src='http://evil.me/evil.js'></iframe>
<image url='https://news.ycombinator.com/y18.gif'>HN</image>
gets compiled to
<ReactMLFragment>
<ReactMLParagraph>
<ReactMLBold>
{'Hello'}
</ReactMLBold>
</ReactMLParagraph>
<ReactMLParagraph>
<ReactMLItalic>
{'World'}
</ReactMLItalic>
</ReactMLParagraph>
<ReactMLParagraph>
<ReactMLLink url={'github.com'}>
{'github.com'}
</ReactMLLink>
</ReactMLParagraph>
<ReactMLParagraph>
<ReactMLImage label={'HN'} url={'https://news.ycombinator.com/y18.gif'} />
</ReactMLParagraph>
</ReactMLFragment>
which in turn will be rendered using React.render
to
<div class="reactml-fragment">
<div class="reactml-paragraph">
<span class="reactml-b" style="font-weight:bold;">Hello</span>
</div>
<div class="reactml-paragraph">
<span class="reactml-i" style="font-style:italic;">World</span>
</div>
<div class="reactml-paragraph">
<a class="reactml-link" href="github.com">github.com</a>
</div>
<div class="reactml-paragraph">
<img alt="HN" class="reactml-image" src="https://news.ycombinator.com/y18.gif"/>
</div>
</div>
You can of course customize:
basic
layout via CSS or overloading,import ReactML from 'react-ml';
React.render(ReactML.compile('<b>Hello world</b>', ReactML.presets.basic));
Components are defined by their tagname (eg. <image>
has tagname image
). It is then up to you to define which
React Element will actually be mapped to your custom component. For example, if we wish to add a <red>
component that
will color its children in red, we would do the following:
compile(source, Object.assign({}, basicPreset, {
red: (attribs, children, transformChildren) =>
<span style={{ color: 'red' }}>
{transformChildren(children)}
</span>,
}));
The signature function for a component definition is:
(attribs: Object, children: Object, transformChildren: Function): React.Element
attribs
contains the attributes of the current node, eg. attribs
for <image bar='foo'>
is { bar: 'foo' }
children
contains the list of the children node,transformChildren
is a reference to the closured compile function to perform recursive transformation of the
children
list.Each object in children can be destructured as { type, data } = child
, where type
can either be text
, in which
case the actual text content is in data
, or tag
, in which case data
and the children
object should be either
ignored or passed to transformChildren
.
FAQs
Make your own Markup Language for React!
We found that react-ml-2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.