js-bbcode-parser

import bbCodeParser from 'js-bbcode-parser'; import BBCodeParser from 'js-bbcode-parser/src/index.js'; // Use the default pre-configured parser const defaultParsed = bbCodeParser.parse('Hello [b]World[/b]! This is a [color=#FF0000]red[/color] text.'); console.log('Default Parser Output:', defaultParsed); // Expected: "Hello <strong>World</strong>! This is a <span style="color:#FF0000">red</span> text." // Create a custom parser instance and add a custom tag const customParser = new BBCodeParser({}); customParser.addCode( 'mention', (content, attr) => `<a href="/users/${attr.id}">@${content}</a>`, ['id'], // Required attribute [] // Optional attributes ); const customParsed = customParser.parse('[mention id=123]Alice[/mention] says hello.'); console.log('Custom Parser Output:', customParsed); // Expected: "<a href="/users/123">@Alice</a> says hello." // IMPORTANT: Sanitize user input before parsing, as this library does not provide XSS protection. const userInput = '[b]Bold text[/b] and potentially malicious <img src=x onerror=alert(1)> content.'; // In a real application, use a dedicated HTML sanitizer library here, e.g., DOMPurify // Example of basic (non-robust) sanitization (DO NOT rely on this for production XSS prevention!) const basicSanitizedInput = userInput.replace(/<script[^>]*>.*?<\/script>/gi, ''); const parsedAndSanitized = bbCodeParser.parse(basicSanitizedInput); console.log('Sanitized Input Output:', parsedAndSanitized);