Registry / serialization / html-parser

html-parser

JSON →
library0.2jsnpmunverified

The `html-parser` library provides a fault-tolerant parser for HTML and XML, designed to process even malformed input without 'explosions'. Its primary feature is robust sanitization capabilities, allowing developers to strip unwanted elements, attributes, and comments from untrusted HTML content. The library operates using a callback-based API, offering granular control over how various HTML tokens (elements, attributes, text, comments, CDATA, doctype) are handled during parsing. Currently at version 0.11.0 and last published over nine years ago, this package is no longer actively maintained. Its key differentiators historically were its resilience to invalid markup and its built-in, configurable sanitization features, making it suitable for preparing user-generated HTML for safe display, though its age raises concerns about modern security vulnerabilities.

serialization
npm install html-parser
github ↗package ↗
INSTALL
IMPORT
SIG · HTML-PARSER
H
html-parser
serializationjavascriptv0.2
Install
—
Import
—
Disk
—
Pass rate
0/ 6
Env Coverage0 / 6
glibc
18–22
musl
18–22
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18–226 runs
build_error
glibc
node 18–226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

htmlParser
✓ const htmlParser = require('html-parser');
✗ import htmlParser from 'html-parser';
This package is CommonJS-only and does not support ES module imports. Direct named imports are also not supported.
parse
✓ const htmlParser = require('html-parser'); htmlParser.parse(htmlString, callbacks);
✗ import { parse } from 'html-parser';
The `parse` method is a property of the main `htmlParser` object, not a direct named export. CommonJS `require` must be used.
sanitize
✓ const htmlParser = require('html-parser'); const sanitizedHtml = htmlParser.sanitize(htmlString, options);
✗ import { sanitize } from 'html-parser';
The `sanitize` method is a property of the main `htmlParser` object, not a direct named export. CommonJS `require` must be used.

This quickstart demonstrates both the callback-based HTML parsing and the sanitization features of the library. It shows how to process an HTML string, logging events for various tokens, and how to remove malicious script tags, event attributes, and comments.

const htmlParser = require('html-parser'); const html = '<!doctype html><html><body onload="alert(\'hello\');">Hello<br />world</body></html>'; console.log('--- Parsing Example ---'); htmlParser.parse(html, { openElement: function(name) { console.log('open: %s', name); }, closeOpenedElement: function(name, token, unary) { console.log('token: %s, unary: %s', token, unary); }, closeElement: function(name) { console.log('close: %s', name); }, comment: function(value) { console.log('comment: %s', value); }, cdata: function(value) { console.log('cdata: %s', value); }, attribute: function(name, value) { console.log('attribute: %s=%s', name, value); }, docType: function(value) { console.log('doctype: %s', value); }, text: function(value) { console.log('text: %s', value); } }); const maliciousHtml = '<script>alert(\'danger!\')</script><p onclick="alert(\'danger!\')">blah blah<!-- useless comment --></p>'; console.log('\n--- Sanitization Example ---'); const sanitized = htmlParser.sanitize(maliciousHtml, { elements: [ 'script' ], // Elements to remove attributes: [ 'onclick' ], // Attributes to remove comments: true // Remove comments }); console.log('Original: %s', maliciousHtml); console.log('Sanitized: %s', sanitized);
Debug
Known issues
breakingThis package is pre-1.0 (v0.11.0) and abandoned, meaning its API is not stable and may have contained breaking changes between minor versions. There is no guarantee of backward compatibility.
fix
Migrate to a maintained HTML parsing and sanitization library like `htmlparser2` or `parse5` for parsing, and a dedicated sanitization library like `dompurify` for security.
affects: <=0.11.0
gotchaThe package is CommonJS-only and does not provide ES module exports. Attempting to use `import` statements will result in errors.
fix
Always use `const htmlParser = require('html-parser');` to import the library in Node.js environments.
affects: >=0.1.0
gotchaThe `sanitize` function, while provided, relies on simple element/attribute blacklists or callback logic. Given the library's abandonment, it is highly unlikely to be robust against modern XSS vectors and other security vulnerabilities. It should not be solely relied upon for security-critical sanitization without thorough, independent auditing.
fix
For secure HTML sanitization, use actively maintained and peer-reviewed libraries such as `dompurify`. Consider server-side sanitization as a primary defense.
affects: >=0.1.0
gotchaThis package is over nine years old and has not been updated. It may contain unpatched security vulnerabilities, performance issues, or incompatibilities with newer Node.js versions or browser environments.
fix
It is strongly recommended to migrate to a modern, actively maintained HTML parsing and sanitization library.
affects: >=0.1.0
Errors
Common errors & fixes
TypeError: htmlParser.parse is not a function
Attempting to use `import { parse } from 'html-parser';` or not correctly requiring the module.
fix
Ensure you are using CommonJS `require` and accessing `parse` as a method of the default export: `const htmlParser = require('html-parser'); htmlParser.parse(...)`
ReferenceError: htmlParser is not defined
The module was not correctly `require`d or is out of scope.
fix
Add `const htmlParser = require('html-parser');` at the top of your file to ensure the module is loaded and accessible.
Sanitized HTML still contains unwanted elements/attributes.
Incorrect configuration of the `elements` or `attributes` options in the `sanitize` method, or using the `comments: false` option.
fix
Review the `sanitize` options carefully. `elements` and `attributes` arrays specify *what to remove*, or provide a callback function that returns `true` for items to be removed. Ensure `comments: true` is set if comments should be stripped.
Upgrade
Version history
0.2latest on npm
Audit
Dependencies

No dependency data recorded yet.

Agent activity
10 hits · last 30 days
node
10
Resources
githubhttps://github.com/tmont/html-parser ↗
packagehttps://www.npmjs.com/package/html-parser ↗
html-parser — npm install html-parser · libregistry