Security News
Input Validation Vulnerabilities Dominate MITRE's 2024 CWE Top 25 List
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
A simple library that provides standard Unicode emoji support across all platforms.
Twemoji v14.0 adheres to the Unicode 14.0 spec and supports the Emoji 14.0 spec. We do not support custom emoji.
The Twemoji library offers support for all Unicode-defined emoji which are recommended for general interchange (RGI).
The folks over at MaxCDN have graciously provided CDN support.
Use the following in the <head>
tag of your HTML document(s):
<script src="https://twemoji.maxcdn.com/v/latest/twemoji.min.js" crossorigin="anonymous"></script>
This guarantees that you will always use the latest version of the library.
If, instead, you'd like to include the latest version explicitly, you can add the following tag:
<script src="https://twemoji.maxcdn.com/v/14.0.2/twemoji.min.js" integrity="sha384-32KMvAMS4DUBcQtHG6fzADguo/tpN1Nh6BAJa2QqZc6/i0K+YPQE+bWiqBRAWuFs" crossorigin="anonymous"></script>
If instead you want to download a specific version, please look at the gh-pages
branch, where you will find the built assets for both our latest and older versions.
Following are all the methods exposed in the twemoji
namespace.
This is the main parsing utility and has 3 overloads per parsing type.
Although there are two kinds of parsing supported by this utility, we recommend you use DOM parsing, explained below. Each type of parsing accepts a callback to generate an image source or an options object with parsing info.
The second kind of parsing is string parsing, explained in the legacy documentation here. This is unrecommended because this method does not sanitize the string or otherwise prevent malicious code from being executed; such sanitization is out of scope.
If the first argument to twemoji.parse
is an HTMLElement
, generated image tags will replace emoji that are inside #text
nodes only without compromising surrounding nodes or listeners, and completely avoiding the usage of innerHTML
.
If security is a major concern, this parsing can be considered the safest option but with a slight performance penalty due to DOM operations that are inevitably costly.
var div = document.createElement('div');
div.textContent = 'I \u2764\uFE0F emoji!';
document.body.appendChild(div);
twemoji.parse(document.body);
var img = div.querySelector('img');
// note the div is preserved
img.parentNode === div; // true
img.src; // https://twemoji.maxcdn.com/v/latest/72x72/2764.png
img.alt; // \u2764\uFE0F
img.className; // emoji
img.draggable; // false
All other overloads described for string
are available in exactly the same way for DOM parsing.
Here's the list of properties accepted by the optional object that can be passed to the parse
function.
{
callback: Function, // default the common replacer
attributes: Function, // default returns {}
base: string, // default MaxCDN
ext: string, // default ".png"
className: string, // default "emoji"
size: string|number, // default "72x72"
folder: string // in case it's specified
// it replaces .size info, if any
}
The function to invoke in order to generate image src
(s).
By default it is a function like the following one:
function imageSourceGenerator(icon, options) {
return ''.concat(
options.base, // by default Twitter Inc. CDN
options.size, // by default "72x72" string
'/',
icon, // the found emoji as code point
options.ext // by default ".png"
);
}
The default url is the same as twemoji.base
, so if you modify the former, it will reflect as default for all parsed strings or nodes.
The default image extension is the same as twemoji.ext
which is ".png"
.
If you modify the former, it will reflect as default for all parsed strings or nodes.
The default class
for each generated image is emoji
. It is possible to specify a different one through this property.
The default asset size is the same as twemoji.size
which is "72x72"
.
If you modify the former, it will reflect as default for all parsed strings or nodes.
In case you don't want to specify a size for the image. It is possible to choose a folder, as in the case of SVG emoji.
twemoji.parse(genericNode, {
folder: 'svg',
ext: '.svg'
});
This will generate urls such https://twemoji.maxcdn.com/svg/2764.svg
instead of using a specific size based image.
Basic utilities / helpers to convert code points to JavaScript surrogates and vice versa.
For a given HEX codepoint, returns UTF-16 surrogate pairs.
twemoji.convert.fromCodePoint('1f1e8');
// "\ud83c\udde8"
For given UTF-16 surrogate pairs, returns the equivalent HEX codepoint.
twemoji.convert.toCodePoint('\ud83c\udde8\ud83c\uddf3');
// "1f1e8-1f1f3"
twemoji.convert.toCodePoint('\ud83c\udde8\ud83c\uddf3', '~');
// "1f1e8~1f1f3"
If you'd like to size the emoji according to the surrounding text, you can add the following CSS to your stylesheet:
img.emoji {
height: 1em;
width: 1em;
margin: 0 .05em 0 .1em;
vertical-align: -0.1em;
}
This will make sure emoji derive their width and height from the font-size
of the text they're shown with. It also adds just a little bit of space before and after each emoji, and pulls them upwards a little bit for better optical alignment.
To properly support emoji, the document character set must be set to UTF-8. This can be done by including the following meta tag in the document <head>
<meta charset="utf-8">
To exclude certain characters from being replaced by twemoji.js, call twemoji.parse() with a callback, returning false for the specific unicode icon. For example:
twemoji.parse(document.body, {
callback: function(icon, options, variant) {
switch ( icon ) {
case 'a9': // © copyright
case 'ae': // ® registered trademark
case '2122': // ™ trademark
return false;
}
return ''.concat(options.base, options.size, '/', icon, options.ext);
}
});
If you're still using our V1 API, you can read our legacy documentation here.
The contributing documentation can be found here.
As an open source project, attribution is critical from a legal, practical and motivational perspective in our opinion. The graphics are licensed under the CC-BY 4.0 which has a pretty good guide on best practices for attribution.
However, we consider the guide a bit onerous and as a project, will accept a mention in a project README or an 'About' section or footer on a website. In mobile applications, a common place would be in the Settings/About section (for example, see the mobile Twitter application Settings->About->Legal section). We would consider a mention in the HTML/JS source sufficient also.
The goal of this project is to simply provide emoji for everyone. We definitely welcome improvements and fixes, but we may not merge every pull request suggested by the community due to the simple nature of the project.
The rules for contributing are available in the CONTRIBUTING.md
file.
Thank you to all of our contributors.
Copyright 2019 Twitter, Inc and other contributors
Code licensed under the MIT License: http://opensource.org/licenses/MIT
Graphics licensed under CC-BY 4.0: https://creativecommons.org/licenses/by/4.0/
FAQs
A Unicode standard based way to implement emoji across all platforms.
The npm package twemoji receives a total of 92,265 weekly downloads. As such, twemoji popularity was classified as popular.
We found that twemoji demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.