The `js-bbcode-parser` library offers a simple and efficient solution for converting BBCode markup into HTML. Currently, at version 5.1.0, the package demonstrates an active development lifecycle with consistent updates within the v5 series since its major release. Its core strength lies in its configurability, allowing developers to extend the parser with custom BBCode tags and their corresponding HTML output. A crucial distinction is its explicit design choice *not* to include built-in XSS protection; implementers are responsible for sanitizing all user-generated input to prevent potential cross-site scripting vulnerabilities, making it a powerful but security-conscious tool. The library supports a comprehensive set of default BBCode tags, including formatting (`[b]`, `[i]`, `[u]`), headings (`[h1]` to `[h6]`), paragraphs (`[p]`), styling (`[color]`, `[size]`), and media (`[img]`, `[email]`). It also handles attributes like `class` and `data-*` within tags, providing flexibility for styled output. Its simple API makes integration straightforward, either by using a pre-configured default parser instance or by creating custom instances for more fine-grained control over the parsing rules.
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
This imports the default pre-configured parser instance, ready for use.
import bbCodeParser from 'js-bbcode-parser';
This imports the class constructor for creating custom parser instances. Note the explicit path to 'src/index.js'.
import BBCodeParser from 'js-bbcode-parser/src/index.js';
For CommonJS environments, the default export needs to be accessed via '.default' due to ESM interop.
const bbCodeParser = require('js-bbcode-parser').default;
Demonstrates basic usage of the default parser, how to create and configure a custom parser with new BBCode tags, and highlights the critical need for XSS sanitization.
import bbCodeParser from 'js-bbcode-parser';
import BBCodeParser from 'js-bbcode-parser/src/index.js';
// Use the default pre-configured parser
const defaultParsed = bbCodeParser.parse('Hello [b]World[/b]! This is a [color=#FF0000]red[/color] text.');
console.log('Default Parser Output:', defaultParsed);
// Expected: "Hello <strong>World</strong>! This is a <span style="color:#FF0000">red</span> text."
// Create a custom parser instance and add a custom tag
const customParser = new BBCodeParser({});
customParser.addCode(
'mention',
(content, attr) => `<a href="/users/${attr.id}">@${content}</a>`,
['id'], // Required attribute
[] // Optional attributes
);
const customParsed = customParser.parse('[mention id=123]Alice[/mention] says hello.');
console.log('Custom Parser Output:', customParsed);
// Expected: "<a href="/users/123">@Alice</a> says hello."
// IMPORTANT: Sanitize user input before parsing, as this library does not provide XSS protection.
const userInput = '[b]Bold text[/b] and potentially malicious <img src=x onerror=alert(1)> content.';
// In a real application, use a dedicated HTML sanitizer library here, e.g., DOMPurify
// Example of basic (non-robust) sanitization (DO NOT rely on this for production XSS prevention!)
const basicSanitizedInput = userInput.replace(/<script[^>]*>.*?<\/script>/gi, '');
const parsedAndSanitized = bbCodeParser.parse(basicSanitizedInput);
console.log('Sanitized Input Output:', parsedAndSanitized);
Upgrade
Version history
Breaking-change detection hasn't run for this library yet.
Audit
Security & dependencies
CVE tracking and dependency tree are planned for a later release.