micromark-extension-gfm-tagfilter
micromark extension to support GFM tag filter.
Contents
- What is this?
- When to use this
- Install
- Use
- API
- Authoring
- HTML
- CSS
- Syntax
- Types
- Compatibility
- Security
- Related
- Contribute
- License
What is this?
This package contains an extension that adds support for the tagfilter enabled by GFM to micromark
. The tagfilter is kinda weird and kinda useless. This package exists for completeness. The tag filter is a naïve attempt at XSS protection. You should use a proper HTML sanitizing algorithm.
When to use this
This project is useful when you want to match how GitHub works. You can use this extension when you are working with micromark
already. When you do, you can instead use micromark-extension-gfm
, which includes this extension, to support all GFM features.
When you want to deal with syntax trees, you should instead use hast-util-sanitize
.
When you use remark and rehype, you should use rehype-sanitize
.
Install
This package is ESM only. In Node.js (version 16+), install with npm:
npm install micromark-extension-gfm-tagfilter
In Deno with esm.sh
:
import {gfmTagfilterHtml} from 'https://esm.sh/micromark-extension-gfm-tagfilter@2'
In browsers with esm.sh
:
<script type="module">
import {gfmTagfilterHtml} from 'https://esm.sh/micromark-extension-gfm-tagfilter@2?bundle'
</script>
Use
import {micromark} from 'micromark'
import {gfmTagfilterHtml} from 'micromark-extension-gfm-tagfilter'
const output = micromark('XSS! <script>alert(1)</script>', {
allowDangerousHtml: true,
htmlExtensions: [gfmTagfilterHtml()]
})
console.log(output)
Yields:
<p>XSS! &lt;script>alert(1)&lt;/script></p>
API
This package exports the identifier gfmTagfilterHtml
. There is no default export.
gfmTagfilterHtml()
Create an HTML extension for micromark
to support GitHubs weird and useless tagfilter when serializing to HTML.
Returns
Extension for micromark
that can be passed in htmlExtensions
to support GitHubs weird and useless tagfilter when serializing to HTML (HtmlExtension
).
Authoring
This package relates to malicious authors, not decent authors.
HTML
GFM tagfilter removes certain dangerous HTML tags: iframe
, noembed
, noframes
, plaintext
, script
, style
, title
, textarea
, and xmp
.
CSS
This package does not relate to CSS.
Syntax
This package does not change how markdown is parsed.
Types
This package is fully typed with TypeScript. It exports no additional types.
Compatibility
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of Node. This means we try to keep the current release line, micromark-extension-gfm-tagfilter@^2
, compatible with Node.js 16.
This package works with micromark
version 3
and later.
Security
While micromark is safe by default, this extension only does something when allowDangerousHtml: true
is passed, which is an unsafe option. This package is not safe.
Related
micromark-extension-gfm
— support all of GFMhast-util-sanitize
— hast utility to make trees saferehype-sanitize
— rehype plugin to sanitize HTML
Contribute
See contributing.md
in micromark/.github
for ways to get started. See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.