From 7ce6840b89fc2b753434f6c86ed656eb861a4e6d Mon Sep 17 00:00:00 2001
From: Titus
This paragraph won’t be part of the note, because it isn’t indented.
-Here is the footnote. ↩
From d38452549d9c01e4cb4516ee2acfdd3b210f62be Mon Sep 17 00:00:00 2001 From: Titus Wormerchanged
\n', 'should allow overriding handlers' ) - processorDangerous = remark() + const processorDangerous3 = remark() .use( /** @type {import('unified').Plugin
Bold!
\n', 'should overwrite a tag-name' ) - processorDangerous = remark() + const processorDangerous5 = remark() .use( /** @type {import('unified').Pluginvar
var
var\n\n',
'should overwrite classes on code'
)
diff --git a/test/integrations/footnotes/output.html b/test/integrations/footnotes/output.html
index 377fd67..f789a38 100644
--- a/test/integrations/footnotes/output.html
+++ b/test/integrations/footnotes/output.html
@@ -8,7 +8,7 @@
+diff --git a/test/fixtures/code/output.md b/test/fixtures/code/output.md new file mode 100644 index 0000000..f14ae1a --- /dev/null +++ b/test/fixtures/code/output.md @@ -0,0 +1,14 @@ ++
+- +
++code.in.a.list(); +- +
+Paragraph.
+- +
+Normal list
+Paragraph.
+
alert('some JavaScript code.');
+
+foo bar baz
+
+alpha bravo charlie
+
+
+ two spaces
+ one
+ two
+ one
+ mixed.
+
diff --git a/test/fixtures/entities-named/output.md b/test/fixtures/entities-named/output.md
new file mode 100644
index 0000000..071e009
--- /dev/null
+++ b/test/fixtures/entities-named/output.md
@@ -0,0 +1,31 @@
+Plain text:
+AT&T with entity, AT&T with numeric entity, AT&T without entity.
+Fenced code language flags:
+Something in the AT&T language
+
+Something in the AT&T language
+
+Something in the AT&T language
+
+Automatic links:
+http://at&t.com, http://at&t.com, and http://at&t.com.
+Link href:
With entity, numeric entity, without entity.
+Link title:
With entity, numeric entity, without entity.
+Image src:
,
,
.
Image alt:
,
,
.
Image title:
,
,
.
Reference link:
Entity, Numeric entity, Literal.
+,
,
.
Reference title:
Entity, Numeric entity, Literal.
+,
,
.
Image Reference alt:
,
,
.
Definitions:
diff --git a/test/fixtures/entities-numerical/output.md b/test/fixtures/entities-numerical/output.md new file mode 100644 index 0000000..c4fa09e --- /dev/null +++ b/test/fixtures/entities-numerical/output.md @@ -0,0 +1,31 @@ +Plain text:
+AT&T with entity, AT&T with numeric entity, AT&T without entity.
+Fenced code language flags:
+Something in the AT&T language
+
+Something in the AT&T language
+
+Something in the AT&T language
+
+Automatic links:
+http://at&t.com, http://at&t.com, and http://at&t.com.
+Link href:
With entity, numeric entity, without entity.
+Link title:
With entity, numeric entity, without entity.
+Image src:
,
,
.
Image alt:
,
,
.
Image title:
,
,
.
Reference link:
Entity, Numeric entity, Literal.
+,
,
.
Reference title:
Entity, Numeric entity, Literal.
+,
,
.
Image Reference alt:
,
,
.
Definitions:
diff --git a/test/fixtures/escape-commonmark/output.md b/test/fixtures/escape-commonmark/output.md new file mode 100644 index 0000000..934d342 --- /dev/null +++ b/test/fixtures/escape-commonmark/output.md @@ -0,0 +1,39 @@ +These should all get escaped:
+Backslash: \
+Backtick: `
+Asterisk: *
+Underscore: _
+Left brace: {
+Right brace: }
+Left bracket: [
+Right bracket: ]
+Left paren: (
+Right paren: )
+Greater-than: >
+Hash: #
+Period: .
+Bang: !
+Plus: +
+Minus: -
+GFM:
+Pipe: |
+Tilde: ~
+Commonmark:
+Quote: "
+Dollar: $
+Percentage: %
+Ampersand: &
+Single quote: '
+Comma: ,
+Forward slash: /
+Colon: :
+Semicolon: ;
+Less-than: <
+Equals: =
+Question mark: ?
+At-sign: @
+Caret: ^
+New line:
+only works in paragraphs.
Two spaces:
+only works in paragraphs.
These should all get escaped:
+Backslash: \
+Backtick: `
+Asterisk: *
+Underscore: _
+Left brace: {
+Right brace: }
+Left bracket: [
+Right bracket: ]
+Left paren: (
+Right paren: )
+Greater-than: >
+Hash: #
+Period: .
+Bang: !
+Plus: +
+Minus: -
+GFM:
+Pipe: |
+Tilde: ~
+Commonmark:
+Quote: "
+Dollar: $
+Percentage: %
+Ampersand: &
+Single quote: '
+Comma: ,
+Forward slash: /
+Colon: :
+Semicolon: ;
+Less-than: <
+Equals: =
+Question mark: ?
+At-sign: @
+Caret: ^
+New line:
+only works in paragraphs.
Two spaces:
+only works in paragraphs.
Foo bar baz qux.
+Alpha bravo charlie.
diff --git a/test/fixtures/html/output.md b/test/fixtures/html/output.md new file mode 100644 index 0000000..6cec140 --- /dev/null +++ b/test/fixtures/html/output.md @@ -0,0 +1,2 @@ +Foo bar baz qux.
diff --git a/test/fixtures/images/output.md b/test/fixtures/images/output.md new file mode 100644 index 0000000..11dab25 --- /dev/null +++ b/test/fixtures/images/output.md @@ -0,0 +1,6 @@ +Loose:
+Loose 2:
+And a rule.
+
diff --git a/test/fixtures/references/output.md b/test/fixtures/references/output.md
new file mode 100644
index 0000000..f074a30
--- /dev/null
+++ b/test/fixtures/references/output.md
@@ -0,0 +1,6 @@
+Entities contains some serious entity tests relating to titles and links +in definitions.
+However, the [missing], [missing][], and [missing][missing] are omitted.
+However, the ![missing], ![missing][], and ![missing][missing] are omitted.
+Same goes for [][empty] and ![][empty].
diff --git a/test/fixtures/rule/output.md b/test/fixtures/rule/output.md new file mode 100644 index 0000000..4851e81 --- /dev/null +++ b/test/fixtures/rule/output.md @@ -0,0 +1,4 @@ +Hello
+world
changed
\n', - 'should allow overriding handlers' - ) - - const processorDangerous3 = remark() - .use( - /** @type {import('unified').Plugin
Bold!
\n', - 'should overwrite a tag-name' - ) + }) - const processorDangerous5 = remark() - .use( - /** @type {import('unified').Pluginchanged
\n' ) - .use(remarkHtml, {sanitize: false}) - - t.equal( - processorDangerous5.processSync('`var`').toString(), - 'var

var
Bold!
\n' ) - .use(remarkHtml, {sanitize: false}) - - t.equal( - processorDangerous7.processSync('```js\nvar\n```\n').toString(), - 'var\n\n',
- 'should overwrite classes on code'
- )
-
- t.equal(
- remark()
- .use(remarkHtml)
- .processSync('## Hello world')
- .toString(),
- 'var
var
var\n\n'
+ )
+ })
- const output = String(fs.readFileSync(path.join(base, name, 'output.html')))
- const input = String(fs.readFileSync(path.join(base, name, 'input.md')))
- const file = toVFile({path: name + '.md', value: input})
- let config = {}
+ await t.test('should be `sanitation: true` by default', async function () {
+ assert.equal(
+ String(
+ await unified()
+ .use(remarkParse)
+ .use(remarkHtml)
+ .process('## Hello world')
+ ),
+ '
Bold!
\n' @@ -148,24 +173,30 @@ test('remarkHtml', async function (t) { String( await unified() .use(remarkParse) - .use( - /** @type {import('unified').Pluginvar
var
--A block quote.
-
code.Pluto (minor-planet designation: 134340 Pluto) is a +dwarf planet in the +Kuiper belt.
``` ## API This package exports no identifiers. -The default export is `remarkHtml`. +The default export is [`remarkHtml`][api-remark-html]. ### `unified().use(remarkHtml[, options])` -Add support for serializing HTML. +Serialize markdown as HTML. + +###### Parameters -##### `options` +* `options` ([`Options`][api-options], optional) + — configuration -Configuration (optional). -All options other than `sanitize` and `handlers` are passed to -[`hast-util-to-html`][hast-util-to-html]. +###### Returns -###### `options.handlers` +Transform ([`Transformer`][unified-transformer]). -This option is a bit advanced as it requires knowledge of ASTs, so we defer -to the documentation available in -[`mdast-util-to-hast`][mdast-util-to-hast]. +###### Notes -###### `options.sanitize` +Passing `sanitize: false` is dangerous. +It allows arbitrary HTML and does not sanitize elements. -How to sanitize the output (`Object` or `boolean`, default: `true`): +### `Options` -* `false` - — output is not sanitized, dangerous raw HTML persists -* `true` - — output is sanitized according to [GitHub’s sanitation rules][github], - dangerous raw HTML is dropped -* `Object` - — `schema` that defines how to sanitize output with - [`hast-util-sanitize`][sanitize], dangerous raw HTML is dropped +Configuration (TypeScript type). + +###### Fields + +* `handlers` ([`Handlers` from + `mdast-util-to-hast`][mdast-util-to-hast-handlers], optional) + — how to turn mdast nodes into hast nodes +* `sanitize` ([`Schema` from + `hast-util-sanitize`][hast-util-sanitize-schema] or `boolean`, default: + `true`) + — sanitize the output, and how +* `...toHtmlOptions` ([`Options` from + `hast-util-to-html`][hast-util-to-html-options], optional) + — other options are passed to `hast-util-to-html` ## Types This package is fully typed with [TypeScript][]. -It exports an `Options` type, which specifies the interface of the accepted -options. +It exports the additional type [`Options`][api-options]. ## Compatibility -Projects maintained by the unified collective are compatible with all maintained +Projects maintained by the unified collective are compatible with maintained versions of Node.js. -As of now, that is Node.js 12.20+, 14.14+, and 16.0+. -Our projects sometimes work with older versions, but this is not guaranteed. -This plugin works with `unified` version 6+ and `remark` version 7+. +When we cut a new major release, we drop support for unmaintained versions of +Node. +This means we try to keep the current release line, `remark-html@^15`, +compatible with Node.js 12. + +This plugin works with `unified` version 6+ and `remark` version 15+. ## Security -Use of `remark-html` is **unsafe** by default and opens you up to -[cross-site scripting (XSS)][xss] attacks. -Pass `sanitize: true` to prevent attacks. -Setting `sanitize` to anything else can be unsafe. +Use of `remark-html` is safe by default. +Passing `sanitize: false` is unsafe and opens you up to +[cross-site scripting (XSS)][wiki-xss] attacks. +A safe schema is used by default, but passing an unsafe schema is unsafe. ## Related @@ -227,9 +221,9 @@ abide by its terms. [downloads]: https://www.npmjs.com/package/remark-html -[size-badge]: https://img.shields.io/bundlephobia/minzip/remark-html.svg +[size-badge]: https://img.shields.io/bundlejs/size/remark-html -[size]: https://bundlephobia.com/result?p=remark-html +[size]: https://bundlejs.com/?q=remark-html [sponsors-badge]: https://opencollective.com/unified/sponsors/badge.svg @@ -243,6 +237,8 @@ abide by its terms. [npm]: https://docs.npmjs.com/cli/install +[esm]: https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c + [esmsh]: https://esm.sh [health]: https://github.com/remarkjs/.github @@ -257,30 +253,34 @@ abide by its terms. [author]: https://wooorm.com -[unified]: https://github.com/unifiedjs/unified +[hast-util-sanitize-schema]: https://github.com/syntax-tree/hast-util-sanitize#schema -[remark]: https://github.com/remarkjs/remark +[hast-util-to-html-options]: https://github.com/syntax-tree/hast-util-to-html#options -[github]: https://github.com/syntax-tree/hast-util-sanitize#schema +[mdast-util-to-hast-handlers]: https://github.com/syntax-tree/mdast-util-to-hast#handlers -[xss]: https://en.wikipedia.org/wiki/Cross-site_scripting +[rehype-format]: https://github.com/rehypejs/rehype-format -[typescript]: https://www.typescriptlang.org +[rehype-highlight]: https://github.com/rehypejs/rehype-highlight -[remark-rehype]: https://github.com/remarkjs/remark-rehype +[rehype-meta]: https://github.com/rehypejs/rehype-meta [rehype-minify]: https://github.com/rehypejs/rehype-minify -[rehype-format]: https://github.com/rehypejs/rehype-format +[rehype-stringify]: https://github.com/rehypejs/rehype/tree/main/packages/rehype-stringify -[rehype-highlight]: https://github.com/rehypejs/rehype-highlight +[remark]: https://github.com/remarkjs/remark -[rehype-meta]: https://github.com/rehypejs/rehype-meta +[remark-rehype]: https://github.com/remarkjs/remark-rehype -[rehype-stringify]: https://github.com/rehypejs/rehype/tree/main/packages/rehype-stringify +[typescript]: https://www.typescriptlang.org + +[unified]: https://github.com/unifiedjs/unified + +[unified-transformer]: https://github.com/unifiedjs/unified#transformer -[sanitize]: https://github.com/syntax-tree/hast-util-sanitize +[wiki-xss]: https://en.wikipedia.org/wiki/Cross-site_scripting -[hast-util-to-html]: https://github.com/syntax-tree/hast-util-to-html +[api-options]: #options -[mdast-util-to-hast]: https://github.com/syntax-tree/mdast-util-to-hast +[api-remark-html]: #unifieduseremarkhtml-options From 80482a52303ec8a659d4a34f7a29757d7c0e03b9 Mon Sep 17 00:00:00 2001 From: Titus Wormer