Skip to content

Commit

Permalink
Add some links
Browse files Browse the repository at this point in the history
  • Loading branch information
wooorm committed Jan 16, 2023
1 parent 30369c8 commit 35b265e
Showing 1 changed file with 13 additions and 7 deletions.
20 changes: 13 additions & 7 deletions readme.md
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ You can instead use [`unist-builder`][u] when creating any unist nodes and
## Install

This package is [ESM only][esm].
In Node.js (version 14.14+ or 16.0+), install with [npm][]:
In Node.js (version 14.14+ and 16.0+), install with [npm][]:

```sh
npm install hastscript
Expand Down Expand Up @@ -146,7 +146,7 @@ Yields:

## API

This package exports the identifiers `h` and `s`.
This package exports the identifiers [`h`][h] and [`s`][s].
There is no default export.

The export map supports the automatic JSX runtime.
Expand Down Expand Up @@ -199,6 +199,7 @@ SVG.
### `Child`

(Lists of) children (TypeScript type).

When strings or numbers are encountered, they are turned into [`Text`][text]
nodes.
[`Root`][root] nodes are treated as “fragments”, meaning that their children
Expand Down Expand Up @@ -300,7 +301,8 @@ console.log(
## Types
This package is fully typed with [TypeScript][].
It exports the additional types `Child`, `Properties`, and `Result`.
It exports the additional types [`Child`][child], [`Properties`][properties],
and [`Result`][result].
## Compatibility
Expand All @@ -323,15 +325,15 @@ const tree = h()

// Somehow someone injected these properties instead of an expected `src` and
// `alt`:
const otherProps = {src: 'x', onError: 'alert(2)'}
const otherProps = {src: 'x', onError: 'alert(1)'}

tree.children.push(h('img', {src: 'default.png', ...otherProps}))
```

Yields:

```html
<img src="x" onerror="alert(2)">
<img src="x" onerror="alert(1)">
```

The following example shows how code can run in a browser because someone stored
Expand All @@ -344,7 +346,7 @@ const tree = h()
const username = {
type: 'element',
tagName: 'script',
children: [{type: 'text', value: 'alert(3)'}]
children: [{type: 'text', value: 'alert(2)'}]
}

tree.children.push(h('span.handle', username))
Expand All @@ -353,7 +355,7 @@ tree.children.push(h('span.handle', username))
Yields:

```html
<span class="handle"><script>alert(3)</script></span>
<span class="handle"><script>alert(2)</script></span>
```

Either do not use user-provided input in `hastscript` or use
Expand Down Expand Up @@ -454,6 +456,10 @@ abide by its terms.

[hast-util-sanitize]: https://github.com/syntax-tree/hast-util-sanitize

[h]: #hselector-properties-children

[s]: #sselector-properties-children

[child]: #child

[properties]: #properties-1
Expand Down

0 comments on commit 35b265e

Please sign in to comment.