diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 37421375cb..da0309349a 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -5,6 +5,9 @@ on: branches: - master +permissions: + contents: read + jobs: Test: if: "!contains(github.event.head_commit.message, '[skip ci]')" @@ -39,6 +42,8 @@ jobs: run: npm run test:lint Release: + permissions: + contents: write needs: [Test, Lint] if: | github.ref == 'refs/heads/master' && diff --git a/README.md b/README.md index 87961a0c79..59017f687b 100644 --- a/README.md +++ b/README.md @@ -47,6 +47,7 @@ npm install -g marked ```sh npm install marked +npm install @types/marked # For TypeScript projects ``` ## Usage diff --git a/docs/INDEX.md b/docs/INDEX.md index a9b3af95d8..3c3c3efafb 100644 --- a/docs/INDEX.md +++ b/docs/INDEX.md @@ -21,8 +21,11 @@ These documentation pages are also rendered using marked 💯 **CLI:** `npm install -g marked` -**In-browser:** `npm install marked` - +**In-browser:** +``` +npm install marked +npm install @types/marked # For TypeScript projects +```

Usage

### Warning: 🚨 Marked does not [sanitize](/using_advanced#options) the output HTML. If you are processing potentially unsafe strings, it's important to filter for possible XSS attacks. Some filtering options include [DOMPurify](https://github.com/cure53/DOMPurify) (recommended), [js-xss](https://github.com/leizongmin/js-xss), [sanitize-html](https://github.com/apostrophecms/sanitize-html) and [insane](https://github.com/bevacqua/insane) on the *output* HTML! 🚨 diff --git a/docs/USING_ADVANCED.md b/docs/USING_ADVANCED.md index f49d320b4d..4491eaca02 100644 --- a/docs/USING_ADVANCED.md +++ b/docs/USING_ADVANCED.md @@ -31,7 +31,6 @@ marked.setOptions({ gfm: true, breaks: false, sanitize: false, - smartLists: true, smartypants: false, xhtml: false }); @@ -58,12 +57,28 @@ console.log(marked.parse(markdownString)); |sanitize |`boolean` |`false` |v0.2.1 |If true, sanitize the HTML passed into `markdownString` with the `sanitizer` function.
**Warning**: This feature is deprecated and it should NOT be used as it cannot be considered secure.
Instead use a sanitize library, like [DOMPurify](https://github.com/cure53/DOMPurify) (recommended), [sanitize-html](https://github.com/apostrophecms/sanitize-html) or [insane](https://github.com/bevacqua/insane) on the output HTML! | |sanitizer |`function`|`null` |v0.3.4 |A function to sanitize the HTML passed into `markdownString`.| |silent |`boolean` |`false` |v0.2.7 |If true, the parser does not throw any exception.| -|smartLists |`boolean` |`false` |v0.2.8 |If true, use smarter list behavior than those found in `markdown.pl`.| |smartypants |`boolean` |`false` |v0.2.9 |If true, use "smart" typographic punctuation for things like quotes and dashes.| |tokenizer |`object` |`new Tokenizer()`|v1.0.0|An object containing functions to create tokens from markdown. See [extensibility](/using_pro) for more details.| |walkTokens |`function` |`null`|v1.1.0|A function which is called for every token. See [extensibility](/using_pro) for more details.| |xhtml |`boolean` |`false` |v0.3.2 |If true, emit self-closing HTML tags for void elements (<br/>, <img/>, etc.) with a "/" as required by XHTML.| +

Known Extensions

+ +Marked can be extended using [custom extensions](/using_pro#extensions). This is a list of extensions that can be used with `marked.use(extension)`. + + + +|Name|Package Name|Description| +|:---|:-----------|:----------| +|[Admonition](https://www.npmjs.com/package/marked-admonition-extension)|[`marked-admonition-extension`](https://www.npmjs.com/package/marked-admonition-extension)| Admonition extension | +|[Bidi](https://github.com/markedjs/marked-bidi)|[`marked-bidi`](https://www.npmjs.com/package/marked-bidi)|Add Bidirectional text support to the HTML| +|[Custom Heading ID](https://github.com/markedjs/marked-custom-heading-id)|[`marked-custom-heading-id`](https://www.npmjs.com/package/marked-custom-heading-id)|Specify a custom heading id in headings with the [Markdown Extended Syntax](https://www.markdownguide.org/extended-syntax/#heading-ids) `# heading {#custom-id}`| +|[Extended Tables](https://github.com/calculuschild/marked-extended-tables)|[`marked-extended-tables`](https://www.npmjs.com/package/marked-extended-tables)|Extends the standard Github-Flavored tables to support advanced features: Column Spanning, Row Spanning, Multi-row headers| +|[GFM Heading ID](https://github.com/markedjs/marked-gfm-heading-id)|[`marked-gfm-heading-id`](https://www.npmjs.com/package/marked-gfm-heading-id)|Use [`github-slugger`](https://github.com/Flet/github-slugger) to create the heading IDs and allow a custom prefix.| +|[Katex Code](https://github.com/UziTech/marked-katex-extension)|[`marked-katex-extension`](https://www.npmjs.com/package/marked-katex-extension)|Render [katex](https://katex.org/) code| +|[LinkifyIt](https://github.com/UziTech/marked-linkify-it)|[`marked-linkify-it`](https://www.npmjs.com/package/marked-linkify-it)|Use [linkify-it](https://github.com/markdown-it/linkify-it) for urls| +|[Misskey-flavored Markdown](https://akkoma.dev/sfr/marked-mfm)|[`marked-mfm`](https://www.npmjs.com/package/marked-mfm)|Custom extension for [Misskey-flavored Markdown](https://github.com/misskey-dev/mfm.js/blob/develop/docs/syntax.md).| +

Inline Markdown

You can parse inline markdown by running markdown through `marked.parseInline`. diff --git a/docs/USING_PRO.md b/docs/USING_PRO.md index e162bdf437..b0d7a0668e 100644 --- a/docs/USING_PRO.md +++ b/docs/USING_PRO.md @@ -15,7 +15,6 @@ marked.use({ gfm: true, breaks: false, sanitize: false, - smartLists: true, smartypants: false, xhtml: false }); diff --git a/docs/_document.html b/docs/_document.html index c3dea889cc..613c822628 100644 --- a/docs/_document.html +++ b/docs/_document.html @@ -38,6 +38,7 @@

Marked Documentation

Advanced Usage