CD2H gitForager

PolymerLabs/crisper

Name: crisper

Owner: PolymerLabs

Description: null

Created: 2015-04-07 22:53:01.0

Updated: 2018-03-14 17:17:14.0

Pushed: 2017-08-01 21:57:14.0

Homepage: null

Size: 48

Language: JavaScript

GitHub Committers

User	Most Recent Commit	# Commits

Other Committers

User	Email	Most Recent Commit	# Commits

README

Crisper

Split inline scripts from an HTML file for CSP compliance

Usage

Command line usage:

index.html | crisper -h build.html -j build.js
per --source index.html --html build.html --js build.js
per --html build.html --js build.js index.html

The output html file will load the output js file at the top of <head> with a <script defer> element.

Optional Flags:

--script-in-head=false
- In the output HTML file, place the script at the end of <body>
- Note: Only use this if you need document.write support.
--only-split
- Do not write a <script> tag in the output HTML file.
--always-write-script
- Always create a .js file, even without any <script> elements.
--csp-hashable-script-loader
- Create a hashable script loader that supports hash-based CSP with strict-dynamic.
- A strict CSP could look like this:
```
pt-src 'strict-dynamic' 'sha256-mUZwR5zj1qMvnzisSvfmC8JczLB0BUKW0Ohr3euDoIA=';
ct-src 'none';
-uri 'self';
```
-v | --version
- Prints version number.

Library usage:

output = crisper({
urce: 'source HTML string',
FileName: 'output js file name.js',
riptInHead: true, //default true
lySplit: false, // default false
waysWriteScript: false // default false

riteFile(htmlOutputFileName, output.html, 'utf-8', ...);
riteFile(jsOutputFileName, output.js, 'utf-8', ...);

Usage with Vulcanize

When using vulcanize, crisper can handle the html string output directly and write the CSP separated files on the command line

anize index.html --inline-script | crisper --html build.html --js build.js

Or programmatically

anize.process('index.html', function(err, cb) {
 (err) {
return cb(err);
else {
var out = crisper({
  source: html,
  jsFileName: 'name of js file.js',
  scriptInHead: true, // default true
  onlySplit: false, // default false
  alwaysWriteScript: false //default false
})
cb(null, out.html, out.js);

Breaking Changes from 1.x

Deprecated split API was removed
require('crisper').split()
Default value of script-in-head flag changed to true
This improves load performance by parallelizing HTML and script parsing
This will break document.write calls
If you experience problems, you can use --script-in-head=false argument or scriptInHead: false in library usage.

Build Tools

This work is supported by the National Institutes of Health's National Center for Advancing Translational Sciences, Grant Number U24TR002306. This work is solely the responsibility of the creators and does not necessarily represent the official views of the National Institutes of Health.