Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Rehype is a powerful HTML processor built on the unified framework. It allows you to parse, transform, and stringify HTML content. It is highly extensible and can be used for a variety of tasks such as sanitizing HTML, extracting content, and transforming HTML structures.
Parsing HTML
Rehype can parse HTML strings into a syntax tree, which can then be manipulated or analyzed.
const rehype = require('rehype');
const html = '<h1>Hello, world!</h1>';
rehype().parse(html);
Transforming HTML
Rehype allows you to transform HTML content by manipulating the syntax tree. You can use plugins or custom functions to modify the tree.
const rehype = require('rehype');
const html = '<h1>Hello, world!</h1>';
rehype()
.use(() => (tree) => {
// Transform the tree
})
.process(html)
.then((file) => {
console.log(String(file));
});
Stringifying HTML
Rehype can convert a syntax tree back into an HTML string, allowing you to output the transformed content.
const rehype = require('rehype');
const tree = { type: 'root', children: [{ type: 'element', tagName: 'h1', properties: {}, children: [{ type: 'text', value: 'Hello, world!' }] }] };
rehype().stringify(tree);
Sanitizing HTML
Rehype can be used to sanitize HTML content, removing potentially dangerous elements and attributes.
const rehype = require('rehype');
const rehypeSanitize = require('rehype-sanitize');
const html = '<script>alert("Hello, world!")</script><p>Safe content</p>';
rehype()
.use(rehypeSanitize)
.process(html)
.then((file) => {
console.log(String(file));
});
Htmlparser2 is a fast and forgiving HTML/XML parser. It is similar to rehype in that it can parse HTML into a tree structure, but it is more focused on speed and less on extensibility and transformations.
Jsdom is a JavaScript implementation of the DOM and HTML standards. It allows you to manipulate HTML content in a way similar to how you would in a browser. Unlike rehype, jsdom provides a full DOM API, making it more suitable for complex manipulations and simulations of browser environments.
Cheerio is a fast, flexible, and lean implementation of core jQuery designed specifically for the server. It allows you to parse and manipulate HTML using a jQuery-like syntax. While rehype focuses on transformations and extensibility, cheerio is more about providing a familiar API for DOM manipulation.
unified processor to parse and compile HTML. Powered by plugins. Part of the unified collective.
rehype-parse
rehype-stringify
Don’t need the parser? Or the compiler? That’s OK.
If you’re in a browser, trust the content, and value a smaller bundle size, use
rehype-dom
instead.
🥇 ZEIT |
🥇 Gatsby |
🥉 Compositor |
Holloway |
You? |
Read more about the unified collective on Medium »
npm:
npm install rehype
var rehype = require('rehype')
var report = require('vfile-reporter')
rehype().process('<title>Hi</title><h2>Hello world!', function(err, file) {
console.log(report(err || file))
console.log(String(file))
})
Yields:
no issues found
<html><head><title>Hi</title></head><body><h2>Hello world!</h2></body></html>
Configuration for rehype-parse
and rehype-stringify
can be set with .data('settings', {/*...*/})
.
See contributing.md
in rehypejs/.github
for ways
to get started.
See support.md
for ways to get help.
Ideas for new plugins and tools can be posted in rehypejs/ideas
.
A curated list of awesome rehype resources can be found in awesome rehype.
This project has a Code of Conduct. By interacting with this repository, organisation, or community you agree to abide by its terms.
FAQs
HTML processor powered by plugins part of the unified collective
The npm package rehype receives a total of 461,471 weekly downloads. As such, rehype popularity was classified as popular.
We found that rehype demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.