19
19
* [ API] ( #api )
20
20
* [ ` h(selector?[, properties][, …children]) ` ] ( #hselector-properties-children )
21
21
* [ ` s(selector?[, properties][, …children]) ` ] ( #sselector-properties-children )
22
+ * [ ` Child ` ] ( #child )
23
+ * [ ` Properties ` ] ( #properties-1 )
24
+ * [ ` Result ` ] ( #result )
25
+ * [ Syntax tree] ( #syntax-tree )
22
26
* [ JSX] ( #jsx )
23
27
* [ Types] ( #types )
24
28
* [ Compatibility] ( #compatibility )
@@ -47,7 +51,7 @@ You can instead use [`unist-builder`][u] when creating any unist nodes and
47
51
## Install
48
52
49
53
This package is [ ESM only] [ esm ] .
50
- In Node.js (version 12.20+, 14.14+, or 16.0+), install with [ npm] [ ] :
54
+ In Node.js (version 14.14+ or 16.0+), install with [ npm] [ ] :
51
55
52
56
``` sh
53
57
npm install hastscript
@@ -151,18 +155,14 @@ build tool (TypeScript, Babel, SWC) as with an `importSource` option or similar.
151
155
152
156
### ` h(selector?[, properties][, …children]) `
153
157
154
- ### ` s(selector?[, properties][, …children]) `
155
-
156
- Create virtual [ ** hast** ] [ hast ] [ * trees* ] [ tree ] for HTML or SVG.
158
+ Create virtual ** [ hast] [ ] ** trees for HTML.
157
159
158
160
##### Signatures
159
161
160
162
* ` h(): root `
161
163
* ` h(null[, …children]): root `
162
164
* ` h(selector[, properties][, …children]): element `
163
165
164
- (and the same for ` s ` ).
165
-
166
166
##### Parameters
167
167
168
168
###### ` selector `
@@ -177,30 +177,97 @@ When nullish, builds a [`Root`][root] instead.
177
177
178
178
###### ` properties `
179
179
180
- Map of properties (` Record<string, any> ` , optional).
181
- Keys should match either the HTML attribute name, or the DOM property name, but
182
- are case-insensitive.
183
- Cannot be given when building a [ ` Root ` ] [ root ] .
180
+ Properties of the element ([ ` Properties ` ] [ properties ] , optional).
184
181
185
182
###### ` children `
186
183
187
- (Lists of) children (` string ` , ` number ` , ` Node ` , ` Array<children> ` , optional).
188
- When strings or numbers are encountered, they are mapped to [ ` Text ` ] [ text ]
189
- nodes.
190
- If [ ` Root ` ] [ root ] nodes are given, their children are used instead.
184
+ Children of the element ([ ` Child ` ] [ child ] or ` Array<Child> ` , optional).
191
185
192
186
##### Returns
193
187
194
- [ ` Element ` ] [ element ] or [ ` Root ` ] [ root ] .
188
+ Created tree ([ ` Result ` ] [ result ] ).
189
+ [ ` Element ` ] [ element ] when a ` selector ` is passed, otherwise [ ` Root ` ] [ root ] .
190
+
191
+ ### ` s(selector?[, properties][, …children]) `
192
+
193
+ Create virtual ** [ hast] [ ] ** trees for SVG.
194
+
195
+ Signatures, parameters, and return value are the same as ` h ` above.
196
+ Importantly, the ` selector ` and ` properties ` parameters are interpreted as
197
+ SVG.
198
+
199
+ ### ` Child `
200
+
201
+ (Lists of) children (TypeScript type).
202
+ When strings or numbers are encountered, they are turned into [ ` Text ` ] [ text ]
203
+ nodes.
204
+ [ ` Root ` ] [ root ] nodes are treated as “fragments”, meaning that their children
205
+ are used instead.
206
+
207
+ ###### Type
208
+
209
+ ``` ts
210
+ type Child =
211
+ | string
212
+ | number
213
+ | null
214
+ | undefined
215
+ | Node
216
+ | Array <string | number | null | undefined | Node >
217
+ ` ` `
218
+
219
+ ### ` Properties `
220
+
221
+ Map of properties (TypeScript type).
222
+ Keys should match either the HTML attribute name, or the DOM property name, but
223
+ are case-insensitive.
224
+
225
+ ###### Type
226
+
227
+ ` ` ` ts
228
+ type Properties = Record <
229
+ string ,
230
+ | string
231
+ | number
232
+ | boolean
233
+ | null
234
+ | undefined
235
+ // For comma- and space-separated values such as `className`:
236
+ | Array <string | number >
237
+ // Accepts value for `style` prop as object.
238
+ | Record <string , string | number >
239
+ >
240
+ ` ` `
241
+
242
+ ### ` Result `
243
+
244
+ Result from a ` h ` (or ` s ` ) call (TypeScript type).
245
+
246
+ ###### Type
247
+
248
+ ` ` ` ts
249
+ type Result = Root | Element
250
+ ` ` `
251
+
252
+ ## Syntax tree
253
+
254
+ The syntax tree is [hast][].
195
255
196
256
## JSX
197
257
198
- ` hastscript ` can be used with JSX.
199
- Either use the automatic runtime set to ` hastscript/html ` (or ` hastscript ` ) or
200
- ` hastscript/svg ` or import ` h ` or ` s ` yourself and define it as the pragma (plus
201
- set the fragment to ` null ` ).
258
+ This package can be used with JSX.
259
+ You should use the automatic JSX runtime set to ` hastscript ` (also available as
260
+ the more explicit name ` hastscript /html ` ) or ` hastscript /svg ` .
261
+
262
+ > 👉 **Note**: while ` h ` supports dots ( ` .` ) for classes or number signs ( ` #` )
263
+ > for IDs in ` selector ` , those are not supported in JSX.
202
264
203
- The example above can then be written like so, using inline pragmas, so
265
+ > 🪦 **Legacy**: you can also use the classic JSX runtime, but this is not
266
+ > recommended.
267
+ > To do so, import ` h ` (or ` s ` ) yourself and define it as the pragma (plus
268
+ > set the fragment to ` null ` ).
269
+
270
+ The Use example above can then be written like so, using inline pragmas, so
204
271
that SVG can be used too:
205
272
206
273
` example -html .jsx ` :
@@ -230,61 +297,23 @@ console.log(
230
297
)
231
298
` ` `
232
299
233
- > 👉 ** Note** : while ` h ` supports dots (` . ` ) for classes or number signs (` # ` )
234
- > for IDs in ` selector ` , those are not supported in JSX.
235
-
236
- You can use [ ` estree-util-build-jsx ` ] [ build-jsx ] to compile JSX away.
237
-
238
- For [ Babel] [ ] , use [ ` @babel/plugin-transform-react-jsx ` ] [ babel-jsx ] and either
239
- pass ` pragma: 'h' ` and ` pragmaFrag: 'null' ` , or pass `importSource:
240
- 'hastscript'`.
241
- This is not perfect as it allows only a single pragma.
242
- Alternatively, Babel also lets you configure this with a comment:
243
-
244
- ``` jsx
245
- /** @jsx s @jsxFrag null */
246
- import {s } from ' hastscript'
247
-
248
- console .log (< rect / > )
249
- ```
250
-
251
- This is useful because it allows using * both* ` html ` and ` svg ` when used in
252
- different files.
253
-
254
300
## Types
255
301
256
302
This package is fully typed with [TypeScript][].
257
- It exports the additional types:
258
-
259
- * ` Child ` — valid value used as a child
260
- * ` Properties ` — valid properties passed to an element
261
- * ` Result ` — output of a ` h ` (or ` s ` ) call
303
+ It exports the additional types ` Child ` , ` Properties ` , and ` Result ` .
262
304
263
305
## Compatibility
264
306
265
307
Projects maintained by the unified collective are compatible with all maintained
266
308
versions of Node.js.
267
- As of now, that is Node.js 12.20+, 14.14+, and 16.0+.
309
+ As of now, that is Node.js 14.14+ and 16.0+.
268
310
Our projects sometimes work with older versions, but this is not guaranteed.
269
311
270
312
## Security
271
313
272
314
Use of ` hastscript ` can open you up to a [cross-site scripting (XSS)][xss]
273
- attack as values are injected into the syntax tree.
274
- The following example shows how a script is injected that runs when loaded in a
275
- browser.
276
-
277
- ``` js
278
- const tree = h ()
279
-
280
- tree .children .push (h (' script' , ' alert(1)' ))
281
- ```
282
-
283
- Yields:
284
-
285
- ``` html
286
- <script >alert (1 ) </script >
287
- ```
315
+ when you pass user-provided input to it because values are injected into the
316
+ syntax tree.
288
317
289
318
The following example shows how an image is injected that fails loading and
290
319
therefore runs code in a browser.
@@ -327,7 +356,7 @@ Yields:
327
356
<span class =" handle" ><script >alert (3 ) </script ></span >
328
357
```
329
358
330
- Either do not use user input in ` hastscript ` or use
359
+ Either do not use user-provided input in ` hastscript ` or use
331
360
[ ` hast-util-santize ` ] [ hast-util-sanitize ] .
332
361
333
362
## Related
@@ -338,14 +367,12 @@ Either do not use user input in `hastscript` or use
338
367
— create xast trees
339
368
* [ ` hast-to-hyperscript ` ] ( https://github.com/syntax-tree/hast-to-hyperscript )
340
369
— turn hast into React, Preact, Vue, etc
341
- * [ ` hast-util-from-dom ` ] ( https://github.com/syntax-tree/hast-util-from-dom )
342
- — turn DOM trees into hast
343
- * [ ` hast-util-select ` ] ( https://github.com/syntax-tree/hast-util-select )
344
- — ` querySelector ` , ` querySelectorAll ` , and ` matches `
345
370
* [ ` hast-util-to-html ` ] ( https://github.com/syntax-tree/hast-util-to-html )
346
371
— turn hast into HTML
347
372
* [ ` hast-util-to-dom ` ] ( https://github.com/syntax-tree/hast-util-to-dom )
348
373
— turn hast into DOM trees
374
+ * [ ` estree-util-build-jsx ` ] ( https://github.com/syntax-tree/estree-util-build-jsx )
375
+ — compile JSX away
349
376
350
377
## Contribute
351
378
@@ -409,8 +436,6 @@ abide by its terms.
409
436
410
437
[ coc ] : https://github.com/syntax-tree/.github/blob/main/code-of-conduct.md
411
438
412
- [ tree ] : https://github.com/syntax-tree/unist#tree
413
-
414
439
[ hast ] : https://github.com/syntax-tree/hast
415
440
416
441
[ element ] : https://github.com/syntax-tree/hast#element
@@ -423,14 +448,14 @@ abide by its terms.
423
448
424
449
[ x ] : https://github.com/syntax-tree/xastscript
425
450
426
- [ build-jsx ] : https://github.com/wooorm/estree-util-build-jsx
427
-
428
- [ babel ] : https://github.com/babel/babel
429
-
430
- [ babel-jsx ] : https://github.com/babel/babel/tree/main/packages/babel-plugin-transform-react-jsx
431
-
432
451
[ parse-selector ] : https://github.com/syntax-tree/hast-util-parse-selector
433
452
434
453
[ xss ] : https://en.wikipedia.org/wiki/Cross-site_scripting
435
454
436
455
[ hast-util-sanitize ] : https://github.com/syntax-tree/hast-util-sanitize
456
+
457
+ [ child ] : #child
458
+
459
+ [ properties ] : #properties-1
460
+
461
+ [ result ] : #result
0 commit comments