Allmark for the Web

A full-featured Markdown parser for the web.

Features

• CommonMark support: Almost full compliance with the CommonMark spec
• GFM extensions: Tables, task lists, strikethrough, autolinks, footnotes, alerts
• Extended ruleset: Additional markdown features (comments, insertions, deletions, etc)
• CLI tool: Convert markdown files from the command line
• Multiple output formats: HTML or console rendering

Installation

pnpm add allmark

Usage

API

The simple approach:

import { consoleRenderers, core, extended, gfm, htmlRenderers, transform } from "allmark";

const markdown = "# Hello, world!";
const html = transform(markdown, gfm, htmlRenderers);

For more control:

import { consoleRenderers, core, extended, gfm, htmlRenderers, parse, render } from "allmark";

const markdown = "# Hello, world!";
const document = parse(markdown, gfm);
const html = render(document, htmlRenderers);

Sanitization

Raw HTML in Markdown is passed through to the output by default. Use sanitize to make untrusted HTML safer before displaying it. The default configuration follows GitHub's sanitizer:

import { gfm, htmlRenderers, parse, render, sanitize } from "allmark";

const markdown = 'Hello <script>alert(1)</script><img src=x onerror="alert(1)">';
const html = sanitize(render(parse(markdown, gfm), htmlRenderers));
// => "<p>Hello <img src="x"></p>\n"

The sanitizer parses the HTML into a tree, filters it against an allowlist, and re-serializes it, so the output is always well-formed regardless of the input. Disallowed tags are unwrapped (their children are kept); tags in removeElements (script, style, iframe, etc.) are removed together with their content. Event handler attributes are always dropped, javascript: and other unsafe URL schemes are removed, and id/name attributes are prefixed with user-content- to prevent DOM clobbering (adjust styles to use the prefix, or remove prefixes in an onload script).

| Option | Default | Description | | ---------------------- | ------------------ | ---------------------------------------------------------------------- | | elements | GitHub's allowlist | Tags to keep; other tags are unwrapped, keeping their children | | removeElements | script-style tags | Tags removed together with their children | | attributes | GitHub's allowlist | Per-tag attribute rules keyed by tag; use "*" for all tags. An entry is an attribute name, [name, regex] to validate the value, or [name, protocols] to restrict URL schemes | | allowComments | false | Keep HTML comments | | allowDataAttributes | true | Keep data-* attributes | | clobberPrefix | "user-content-" | Prefix for id/name values; set to "" to disable |

CLI

# Install globally
pnpm add -g allmark

# Convert markdown to HTML
allmark input.md

# With options
allmark input.md -o output.html -r gfm -f html

CLI options:

• -o, --output: Output file path (defaults to stdout)
• -r, --ruleset: Ruleset to use (core, gfm, extended; default: extended)
• -f, --format: Output format (html, console; default: html)
• -s, --sanitize: Sanitize the HTML output (implies html format)
• -h, --help: Show help message

Rulesets

| Ruleset | Description | | ---------- | ------------------------------------- | | core | CommonMark spec only | | gfm | CommonMark + GitHub Flavored Markdown | | extended | GFM + additional features |

Development

pnpm check        # TypeScript type checking + linting
pnpm build        # Type check + bundle
pnpm test         # Run tests (watch mode)
pnpm format       # Format with Prettier