A tiny, super fast, namespace aware, sax-style XML parser.
Installations
npm install saxen
Developer Guide
Typescript
No
Module System
ESM
Min. Node Version
>= 18
Node Version
20.11.1
NPM Version
10.2.4
Contributors
Unable to fetch Contributors
Languages
JavaScript (100%)
Developer
Download Statistics
Total Downloads
10,657,058
Last Day
5,954
Last Week
35,067
Last Month
301,916
Last Year
3,608,133
GitHub Statistics
18 Stars
326 Commits
4 Forks
5 Watching
1 Branches
1 Contributors
Package Meta Information
Latest Version
10.0.0
Package Id
saxen@10.0.0
Unpacked Size
146.14 kB
Size
25.53 kB
File Count
7
NPM Version
10.2.4
Node Version
20.11.1
Publised On
05 Mar 2024
Total Downloads
Cumulative downloads
Total Downloads
10,657,058
Last day
-25.9%
5,954
Compared to previous day
Last week
-48.2%
35,067
Compared to previous week
Last month
-16.7%
301,916
Compared to previous month
Last year
46.5%
3,608,133
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dev Dependencies
7
/saxen/
parser
A tiny, super fast, namespace aware sax-style XML parser written in plain JavaScript.
Features
- (optional) entity decoding and attribute parsing
- (optional) namespace aware
- element / attribute normalization in namespaced mode
- tiny (
2.6Kb
minified + gzipped) - pretty damn fast
Usage
1var { 2 Parser 3} = require('saxen'); 4 5var parser = new Parser(); 6 7// enable namespace parsing: element prefixes will 8// automatically adjusted to the ones configured here 9// elements in other namespaces will still be processed 10parser.ns({ 11 'http://foo': 'foo', 12 'http://bar': 'bar' 13}); 14 15parser.on('openTag', function(elementName, attrGetter, decodeEntities, selfClosing, getContext) { 16 17 elementName; 18 // with prefix, i.e. foo:blub 19 20 var attrs = attrGetter(); 21 // { 'bar:aa': 'A', ... } 22}); 23 24parser.parse('<blub xmlns="http://foo" xmlns:bar="http://bar" bar:aa="A" />');
Supported Hooks
We support the following parse hooks:
openTag(elementName, attrGetter, decodeEntities, selfClosing, contextGetter)
closeTag(elementName, decodeEntities, selfClosing, contextGetter)
error(err, contextGetter)
warn(warning, contextGetter)
text(value, decodeEntities, contextGetter)
cdata(value, contextGetter)
comment(value, decodeEntities, contextGetter)
attention(str, decodeEntities, contextGetter)
question(str, contextGetter)
In contrast to error
, warn
receives recoverable errors, such as malformed attributes.
In proxy mode, openTag
and closeTag
a view of the current element replaces the raw element name. In addition element attributes are not passed as a getter to openTag
. Instead, they get exposed via the element.attrs
:
openTag(element, decodeEntities, selfClosing, contextGetter)
closeTag(element, selfClosing, contextGetter)
Namespace Handling
In namespace mode, the parser will adjust tag and attribute namespace prefixes before
passing the elements name to openTag
or closeTag
. To do that, you need to
configure default prefixes for wellknown namespaces:
1parser.ns({ 2 'http://foo': 'foo', 3 'http://bar': 'bar' 4});
To skip the adjustment and still process namespace information:
1parser.ns();
Proxy Mode
In this mode, the first argument passed to openTag
and closeTag
is an object that exposes more internal XML parse state. This needs to be explicity enabled by instantiating the parser with { proxy: true }
.
1// instantiate parser with proxy=true 2var parser = new Parser({ proxy: true }); 3 4parser.ns({ 5 'http://foo-ns': 'foo' 6}); 7 8parser.on('openTag', function(el, decodeEntities, selfClosing, getContext) { 9 el.originalName; // root 10 el.name; // foo:root 11 el.attrs; // { 'xmlns:foo': ..., id: '1' } 12 el.ns; // { xmlns: 'foo', foo: 'foo', foo$uri: 'http://foo-ns' } 13}); 14 15parser.parse('<root xmlns:foo="http://foo-ns" id="1" />')
Proxy mode comes with a performance penelty of roughly five percent.
Caution! For performance reasons the exposed element is a simple view into the current parser state. Because of that, it will change with the parser advancing and cannot be cached. If you would like to retain a persistent copy of the values, create a shallow clone:
1parser.on('openTag', function(el) { 2 var copy = Object.assign({}, el); 3 // copy, ready to keep around 4});
Non-Features
/saxen/
lacks some features known in other XML parsers such as sax-js:
- no support for parsing loose documents, such as arbitrary HTML snippets
- no support for text trimming
- no automatic entity decoding
- no automatic attribute parsing
...and that is ok ❤.
Credits
We build on the awesome work done by easysax.
/saxen/
is named after Sachsen, a federal state of Germany. So geht sächsisch!
LICENSE
MIT
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/nikku/.github/SECURITY.md:1
- Info: Found linked content: github.com/nikku/.github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/nikku/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/nikku/.github/SECURITY.md:1
Reason
2 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Reason
7 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Reason
dependency not pinned by hash detected -- score normalized to 4
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CI.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/nikku/saxen/CI.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CI.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/nikku/saxen/CI.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/CI.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/nikku/saxen/CI.yml/main?enable=pin
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
- Info: 1 out of 1 npmCommand dependencies pinned
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/CI.yml:1
- Info: no jobLevel write permissions found
Reason
Found 0/30 approved changesets -- score normalized to 0
Reason
no SAST tool detected
Details
- Warn: no pull requests merged into dev branch
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'main'
Score
4.6
/10
Last Scanned on 2025-01-06
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More