unified

Project: micromark/micromark-extension-gfm-tagfilter

Package: micromark-extension-gfm-tagfilter@1.0.1

  1. Dependents: 0
  2. micromark extension to support GFM tagfilter
  1. unified 169
  2. markdown 136
  3. html 118
  4. micromark 20
  5. gfm 19
  6. micromark-extension 17
  7. filter 5
  8. tagfilter 3
  9. tag 3

micromark-extension-gfm-tagfilter

Build Coverage Downloads Size Sponsors Backers Chat

micromark extension to support GFM tag filter.

Contents

What is this?

This package contains extensions that add support for the tagfilter enabled by GFM to micromark. The tagfilter is kinda weird and kinda useless. This package exists for completeness. The tag filter is a naïve attempt at XSS protection. You should use a proper HTML sanitizing algorithm.

When to use this

These tools are all low-level. In many cases, you want to use remark-gfm with remark instead. It doesn’t use this extension, as with remark (and rehype) there’s a better alternative: rehype-sanitize.

Even when you want to use micromark, you likely want to use micromark-extension-gfm to support all GFM features. That extension includes this extension.

When working with syntax trees (mdast), you should turn it into hast and then use hast-util-sanitize.

Install

This package is ESM only. In Node.js (version 12.20+, 14.14+, 16.0+, or 18.0+), install with npm:

npm install micromark-extension-gfm-tagfilter

In Deno with esm.sh:

import {gfmTagfilterHtml} from 'https://esm.sh/micromark-extension-gfm-tagfilter@1'

In browsers with esm.sh:

<script type="module">
  import {gfmTagfilterHtml} from 'https://esm.sh/micromark-extension-gfm-tagfilter@1?bundle'
</script>

Use

import {micromark} from 'micromark'
import {gfmTagfilterHtml} from 'micromark-extension-gfm-tagfilter'

const output = micromark('XSS! <script>alert(1)</script>', {
  allowDangerousHtml: true,
  htmlExtensions: [gfmTagfilterHtml]
})

console.log(output)

Yields:

<p>XSS! &lt;script>alert(1)&lt;/script></p>

API

This package exports the identifier gfmTagfilterHtml. There is no default export.

gfmTagfilterHtml

HTML extension for micromark (passed in htmlExtensions).

HTML

GFM tagfilter removes certain dangerous HTML tags: iframe, noembed, noframes, plaintext, script, style, title, textarea, and xmp.

CSS

This package does not relate to CSS.

Syntax

This package does not change how markdown is parsed.

Types

This package is fully typed with TypeScript. It exports no additional types.

Compatibility

This package is at least compatible with all maintained versions of Node.js. As of now, that is Node.js 12.20+, 14.14+, 16.0+, and 18.0+. It also works in Deno and modern browsers.

Security

While micromark is safe by default, this extension only does something when allowDangerousHtml: true is passed, which is an unsafe option. This package is not safe.

Contribute

See contributing.md in micromark/.github for ways to get started. See support.md for ways to get help.

This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.

License

MIT © Titus Wormer