# crisper

> Make an HTML file with inline scripts CSP compliant

Latest version **2.1.1** (published 2017-08-01) · BSD-3-Clause license · 0 weekly downloads

## Install

```sh
npm install crisper
pnpm add crisper
yarn add crisper
bun add crisper
```

Provides the command `crisper`.

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 2.1.1 |
| Published | 2017-08-01 |
| First published | 2015-04-08 |
| Weekly downloads | 0 |
| License | BSD-3-Clause |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 3 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 106 |
| Author | The Polymer Authors |
| Maintainers | azakus, garlicnation, nevir |

## Links

- npm: https://www.npmjs.com/package/crisper
- Repository: https://github.com/PolymerLabs/crisper
- Issues: https://github.com/PolymerLabs/crisper/issues
- npm.io page: https://npm.io/package/crisper

## Dependencies (3)

- [dom5](https://npm.io/package/dom5.md) ^1.0.1
- [command-line-args](https://npm.io/package/command-line-args.md) ^3.0.1
- [command-line-usage](https://npm.io/package/command-line-usage.md) ^3.0.8

## Recent versions

- 2.1.1 (latest) — 2017-08-01
- 2.1.0 — 2017-07-31
- 2.0.2 — 2016-04-05
- 2.0.1 — 2015-11-23
- 2.0.0 — 2015-11-05
- 1.2.0 — 2015-10-23
- 1.1.0 — 2015-10-05
- 1.0.7 — 2015-08-06
- 1.0.6 — 2015-08-06
- 1.0.5 — 2015-08-05
- 1.0.4 — 2015-07-27
- 1.0.3 — 2015-04-09
- 1.0.2 — 2015-04-09
- 1.0.1 — 2015-04-08
- 1.0.0 — 2015-04-08

## README

# Crisper
> Split inline scripts from an HTML file for CSP compliance

## Usage

Command line usage:

```
cat index.html | crisper -h build.html -j build.js
crisper --source index.html --html build.html --js build.js
crisper --html build.html --js build.js index.html
```

The output html file will load the output js file at the top of `<head>` with a `<script defer>` element.

Optional Flags:

  - `--script-in-head=false`
    - In the output HTML file, place the script at the end of `<body>`
    - **Note**: Only use this if you need `document.write` support.
  - `--only-split`
    - Do not write a `<script>` tag in the output HTML
      file.
  - `--always-write-script`
    - Always create a .js file, even without any `<script>`
      elements.
  - `--csp-hashable-script-loader`
    - Create a hashable script loader that supports hash-based CSP with strict-dynamic.
    - A strict CSP could look like this:
    ```
    script-src 'strict-dynamic' 'sha256-mUZwR5zj1qMvnzisSvfmC8JczLB0BUKW0Ohr3euDoIA=';
    object-src 'none';
    base-uri 'self';
    ```
  - `-v` | `--version`
    - Prints version number.

Library usage:

```js
var output = crisper({
  source: 'source HTML string',
  jsFileName: 'output js file name.js',
  scriptInHead: true, //default true
  onlySplit: false, // default false
  alwaysWriteScript: false // default false
});
fs.writeFile(htmlOutputFileName, output.html, 'utf-8', ...);
fs.writeFile(jsOutputFileName, output.js, 'utf-8', ...);
```

## Usage with Vulcanize

When using [vulcanize](https://github.com/Polymer/vulcanize), crisper can handle
the html string output directly and write the CSP separated files on the command
line

```
vulcanize index.html --inline-script | crisper --html build.html --js build.js
```

Or programmatically

```js
vulcanize.process('index.html', function(err, cb) {
  if (err) {
    return cb(err);
  } else {
    var out = crisper({
      source: html,
      jsFileName: 'name of js file.js',
      scriptInHead: true, // default true
      onlySplit: false, // default false
      alwaysWriteScript: false //default false
    })
    cb(null, out.html, out.js);
  }
});
```

## Breaking Changes from 1.x
- Deprecated `split` API was removed
  - `require('crisper').split()`
- Default value of `script-in-head` flag changed to true
  - This improves load performance by parallelizing HTML and script parsing
  - This will break `document.write` calls
  - If you experience problems, you can use `--script-in-head=false` argument or
      `scriptInHead: false` in library usage.

## Build Tools

- [gulp-crisper](https://npmjs.com/package/gulp-crisper)
- [grunt-crisper](https://www.npmjs.com/package/grunt-crisper)

---
_Source: https://npm.io/package/crisper · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._
