Installations
npm install htmlparser2
Developer
Developer Guide
Module System
CommonJS, ESM
Min. Node Version
Typescript Support
Yes
Node Version
21.5.0
NPM Version
10.2.4
Statistics
4,460 Stars
2,090 Commits
377 Forks
51 Watching
9 Branches
57 Contributors
Updated on 27 Nov 2024
Bundle Size
128.29 kB
Minified
58.67 kB
Minified + Gzipped
Languages
TypeScript (98.7%)
HTML (1.11%)
JavaScript (0.19%)
Total Downloads
Cumulative downloads
Total Downloads
5,984,076,176
Last day
-1.8%
6,746,640
Compared to previous day
Last week
3.7%
35,711,360
Compared to previous week
Last month
13.2%
145,927,187
Compared to previous month
Last year
14.3%
1,489,518,574
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
htmlparser2
The fast & forgiving HTML/XML parser.
htmlparser2 is the fastest HTML parser, and takes some shortcuts to get there. If you need strict HTML spec compliance, have a look at parse5.
Installation
npm install htmlparser2
A live demo of htmlparser2
is available on AST Explorer.
Ecosystem
Name | Description |
---|---|
htmlparser2 | Fast & forgiving HTML/XML parser |
domhandler | Handler for htmlparser2 that turns documents into a DOM |
domutils | Utilities for working with domhandler's DOM |
css-select | CSS selector engine, compatible with domhandler's DOM |
cheerio | The jQuery API for domhandler's DOM |
dom-serializer | Serializer for domhandler's DOM |
Usage
htmlparser2
itself provides a callback interface that allows consumption of documents with minimal allocations.
For a more ergonomic experience, read Getting a DOM below.
1import * as htmlparser2 from "htmlparser2"; 2 3const parser = new htmlparser2.Parser({ 4 onopentag(name, attributes) { 5 /* 6 * This fires when a new tag is opened. 7 * 8 * If you don't need an aggregated `attributes` object, 9 * have a look at the `onopentagname` and `onattribute` events. 10 */ 11 if (name === "script" && attributes.type === "text/javascript") { 12 console.log("JS! Hooray!"); 13 } 14 }, 15 ontext(text) { 16 /* 17 * Fires whenever a section of text was processed. 18 * 19 * Note that this can fire at any point within text and you might 20 * have to stitch together multiple pieces. 21 */ 22 console.log("-->", text); 23 }, 24 onclosetag(tagname) { 25 /* 26 * Fires when a tag is closed. 27 * 28 * You can rely on this event only firing when you have received an 29 * equivalent opening tag before. Closing tags without corresponding 30 * opening tags will be ignored. 31 */ 32 if (tagname === "script") { 33 console.log("That's it?!"); 34 } 35 }, 36}); 37parser.write( 38 "Xyz <script type='text/javascript'>const foo = '<<bar>>';</script>", 39); 40parser.end();
Output (with multiple text events combined):
--> Xyz
JS! Hooray!
--> const foo = '<<bar>>';
That's it?!
This example only shows three of the possible events. Read more about the parser, its events and options in the wiki.
Usage with streams
While the Parser
interface closely resembles Node.js streams, it's not a 100% match.
Use the WritableStream
interface to process a streaming input:
1import { WritableStream } from "htmlparser2/lib/WritableStream"; 2 3const parserStream = new WritableStream({ 4 ontext(text) { 5 console.log("Streaming:", text); 6 }, 7}); 8 9const htmlStream = fs.createReadStream("./my-file.html"); 10htmlStream.pipe(parserStream).on("finish", () => console.log("done"));
Getting a DOM
The DomHandler
produces a DOM (document object model) that can be manipulated using the DomUtils
helper.
1import * as htmlparser2 from "htmlparser2"; 2 3const dom = htmlparser2.parseDocument(htmlString);
The DomHandler
, while still bundled with this module, was moved to its own module.
Have a look at that for further information.
Parsing Feeds
htmlparser2
makes it easy to parse RSS, RDF and Atom feeds, by providing a parseFeed
method:
1const feed = htmlparser2.parseFeed(content, options);
Performance
After having some artificial benchmarks for some time, @AndreasMadsen published his htmlparser-benchmark
, which benchmarks HTML parses based on real-world websites.
At the time of writing, the latest versions of all supported parsers show the following performance characteristics on GitHub Actions (sourced from here):
htmlparser2 : 2.17215 ms/file ± 3.81587
node-html-parser : 2.35983 ms/file ± 1.54487
html5parser : 2.43468 ms/file ± 2.81501
neutron-html5parser: 2.61356 ms/file ± 1.70324
htmlparser2-dom : 3.09034 ms/file ± 4.77033
html-dom-parser : 3.56804 ms/file ± 5.15621
libxmljs : 4.07490 ms/file ± 2.99869
htmljs-parser : 6.15812 ms/file ± 7.52497
parse5 : 9.70406 ms/file ± 6.74872
htmlparser : 15.0596 ms/file ± 89.0826
html-parser : 28.6282 ms/file ± 22.6652
saxes : 45.7921 ms/file ± 128.691
html5 : 120.844 ms/file ± 153.944
How does this module differ from node-htmlparser?
In 2011, this module started as a fork of the htmlparser
module.
htmlparser2
was rewritten multiple times and, while it maintains an API that's mostly compatible with htmlparser
, the projects don't share any code anymore.
The parser now provides a callback interface inspired by sax.js (originally targeted at readabilitySAX). As a result, old handlers won't work anymore.
The DefaultHandler
was renamed to clarify its purpose (to DomHandler
). The old name is still available when requiring htmlparser2
and your code should work as expected.
The RssHandler
was replaced with a getFeed
function that takes a DomHandler
DOM and returns a feed object. There is a parseFeed
helper function that can be used to parse a feed from a string.
Security contact information
To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.
htmlparser2
for enterprise
Available as part of the Tidelift Subscription.
The maintainers of htmlparser2
and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. Learn more.
No vulnerabilities found.
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
no binaries found in the repo
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (30) are checked with a SAST tool
Reason
2 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
Reason
dependency not pinned by hash detected -- score normalized to 4
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/fb55/htmlparser2/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/fb55/htmlparser2/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/fb55/htmlparser2/codeql-analysis.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/dependabot-automerge.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/fb55/htmlparser2/dependabot-automerge.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-test.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/fb55/htmlparser2/nodejs-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-test.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/fb55/htmlparser2/nodejs-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-test.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/fb55/htmlparser2/nodejs-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-test.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/fb55/htmlparser2/nodejs-test.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs-test.yml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/fb55/htmlparser2/nodejs-test.yml/master?enable=pin
- Info: 0 out of 7 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 third-party GitHubAction dependencies pinned
- Info: 2 out of 2 npmCommand dependencies pinned
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:17
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:18
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/nodejs-test.yml:31
- Warn: jobLevel 'checks' permission set to 'write': .github/workflows/nodejs-test.yml:32
- Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/dependabot-automerge.yml:7
- Info: topLevel 'contents' permission set to 'read': .github/workflows/nodejs-test.yml:15
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Score
7
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More