Gathering detailed insights and metrics for rehype-raw
Gathering detailed insights and metrics for rehype-raw
Installations
npm install rehype-rawDeveloper
Developer Guide
BETA
Module System
ESM
Min. Node Version
Typescript Support
Yes
Node Version
20.0.0
NPM Version
9.7.2
Statistics
143 Stars
113 Commits
9 Forks
8 Watching
1 Branches
10 Contributors
Updated on 27 Nov 2024
Bundle Size
193.15 kB
Minified
57.76 kB
Minified + Gzipped
Languages
JavaScript (100%)
Total Downloads
Cumulative downloads
Total Downloads
114,726,129
Last day
0.5%
312,468
Compared to previous day
Last week
2.6%
1,602,061
Compared to previous week
Last month
14.3%
6,720,839
Compared to previous month
Last year
108.6%
62,201,202
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Versions
rehype-raw
rehype plugin to parse the tree (and raw nodes) again, keeping positional info okay.
Contents
- What is this?
- When should I use this?
- Install
- Use
- API
- Types
- Compatibility
- Security
- Contribute
- License
What is this?
This package is a unified (rehype) plugin to parse a document again.
To understand how it works, requires knowledge of ASTs (specifically, hast).
This plugin passes each node and embedded raw HTML through an HTML parser
(parse5), to recreate a tree exactly as how a browser would parse
it, while keeping the original data and positional info intact.
unified is a project that transforms content with abstract syntax trees (ASTs). rehype adds support for HTML to unified. hast is the HTML AST that rehype uses. This is a rehype plugin that parses the tree again.
When should I use this?
This plugin is particularly useful when coming from markdown and wanting to
support HTML embedded inside that markdown (which requires passing
allowDangerousHtml: true to remark-rehype).
Markdown dictates how, say, a list item or emphasis can be parsed.
We can use that to turn the markdown syntax tree into an HTML syntax tree.
But markdown also dictates that things that look like HTML, are passed through
untouched, even when it just looks like XML but doesn’t really make sense, so we
can’t normally use these strings of “HTML” to create an HTML syntax tree.
This plugin can.
It can be used to take those strings of HTML and include them into the syntax
tree as actual nodes.
If your final result is HTML and you trust content, then “strings” are fine
(you can pass allowDangerousHtml: true to rehype-stringify, which passes
HTML through untouched).
But there are two main cases where a proper syntax tree is preferred:
- rehype plugins need a proper syntax tree as they operate on actual nodes to inspect or transform things, they can’t operate on strings of HTML
- other output formats (React, MDX, etc) need actual nodes and can’t handle strings of HTML
This plugin is built on hast-util-raw, which does the work on
syntax trees.
rehype focusses on making it easier to transform content by abstracting such
internals away.
Install
This package is ESM only. In Node.js (version 16+), install with npm:
1npm install rehype-raw
In Deno with esm.sh:
1import rehypeRaw from 'https://esm.sh/rehype-raw@7'
In browsers with esm.sh:
1<script type="module"> 2 import rehypeRaw from 'https://esm.sh/rehype-raw@7?bundle' 3</script>
Use
Say we have the following markdown file example.md:
1<div class="note"> 2 3A mix of *markdown* and <em>HTML</em>. 4 5</div>
…and our module example.js looks as follows:
1import rehypeDocument from 'rehype-document' 2import rehypeFormat from 'rehype-format' 3import rehypeRaw from 'rehype-raw' 4import rehypeStringify from 'rehype-stringify' 5import remarkParse from 'remark-parse' 6import remarkRehype from 'remark-rehype' 7import {read} from 'to-vfile' 8import {unified} from 'unified' 9 10const file = await unified() 11 .use(remarkParse) 12 .use(remarkRehype, {allowDangerousHtml: true}) 13 .use(rehypeRaw) 14 .use(rehypeDocument, {title: '🙌'}) 15 .use(rehypeFormat) 16 .use(rehypeStringify) 17 .process(await read('example.md')) 18 19console.log(String(file))
…now running node example.js yields:
1<!doctype html> 2<html lang="en"> 3 <head> 4 <meta charset="utf-8"> 5 <title>🙌</title> 6 <meta name="viewport" content="width=device-width, initial-scale=1"> 7 </head> 8 <body> 9 <div class="note"> 10 <p>A mix of <em>markdown</em> and <em>HTML</em>.</p> 11 </div> 12 </body> 13</html>
API
This package exports no identifiers.
The default export is rehypeRaw.
unified().use(rehypeRaw[, options])
Parse the tree (and raw nodes) again, keeping positional info okay.
Parameters
options(Options, optional) — configuration
Returns
Transform (Transformer).
Options
Configuration (TypeScript type).
Fields
passThrough(Array<string>, default:[]) — list of custom hast node types to pass through (as in, keep); this option is a bit advanced as it requires knowledge of ASTs, so we defer to the docs inhast-util-rawtagfilter?(boolean | null | undefined) — whether to disallow irregular tags inrawnodes according to GFM tagfilter (default:false); this affects the following tags, grouped by their kind:RAWTEXT(iframe,noembed,noframes,style,xmp),RCDATA(textarea,title),SCRIPT_DATA(script),PLAINTEXT(plaintext); when you know that you do not want authors to write these tags, you can enable this option to prevent their use from running amok.
Types
This package is fully typed with TypeScript.
It exports the additional type Options.
The Raw node type is registered by and exposed from
remark-rehype.
Compatibility
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, rehype-raw@^7, compatible
with Node.js 16.
Security
The allowDangerousHtml option in remark-rehype is
dangerous, so see that plugin on how to make it safe.
Otherwise, this plugin is safe.
Contribute
See contributing.md in rehypejs/.github for ways
to get started.
See support.md for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
License
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: license:0
- Info: FSF or OSI recognized license: MIT License: license:0
Reason
0 existing vulnerabilities detected
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/rehypejs/.github/security.md:1
- Info: Found linked content: github.com/rehypejs/.github/security.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/rehypejs/.github/security.md:1
- Info: Found text in security policy: github.com/rehypejs/.github/security.md:1
Reason
9 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 9
Reason
Found 2/30 approved changesets -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/bb.yml:1
- Warn: no topLevel permission defined: .github/workflows/main.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/bb.yml:5: update your workflow using https://app.stepsecurity.io/secureworkflow/rehypejs/rehype-raw/bb.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:6: update your workflow using https://app.stepsecurity.io/secureworkflow/rehypejs/rehype-raw/main.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:7: update your workflow using https://app.stepsecurity.io/secureworkflow/rehypejs/rehype-raw/main.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/rehypejs/rehype-raw/main.yml/main?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/main.yml:11
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'main'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 2 are checked with a SAST tool
Score
4.9
/10
Last Scanned on 2024-11-18
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More