Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: cssnano transformations are unsafe in custom property values #1456

Open
nex3 opened this issue Nov 28, 2022 · 2 comments
Open

[Bug]: cssnano transformations are unsafe in custom property values #1456

nex3 opened this issue Nov 28, 2022 · 2 comments
Labels
Milestone

Comments

@nex3
Copy link
Contributor

nex3 commented Nov 28, 2022

Describe the bug

In cssnano compilation modes that seek to guarantee exact behavioral equivalence between the input and output CSS, transformations on custom property values should be substantially limited relative to what they are now. Custom properties aren't just used for configuring values elsewhere in the stylesheet; they may also be used to communicate information from the stylesheet to JavaScript (as in Polymer.js for example), and so the details of their JS serialization is semantically relevant. cssnano currently modifies these values like any other property, which can change the serialization and thus the semantics of the stylesheet.

There are two broad categories of issue here:

  1. The existence of whitespace tokens is visible to JS serialization, so --foo: bar and --foo:bar are meaningfully different. cssnano will convert the former to the latter.

  2. There's no guarantee that a custom property's value will be parsed in a context where a CSS color is meaningful, so --foo: rgb(0 0 0) and --foo: #000 are meaningfully different. cssnano will convert the former to the latter.

The second issue covers essentially all value-level cssnano optimizations, almost none of which are safe to perform on a custom property value.

Expected behaviour

There should at least be a way to tell cssnano not to make changes that could affect the semantics of the compiled CSS—which is to say, to disable essentially all value-level conversions for custom properties unless they don't affect the way those properties are serialized to JS values. Ideally, this configuration would be enabled in cssnano-preset-default, since that advertises itself as making no assumptions about how the CSS will be used.

Steps to reproduce

Copy/paste this into https://cssnano.co/playground/:

a {
  --foo: rgb(0 0 0);
}

Version

5.1.14

Preset

default

Environment

cssnano playground

Package details

cssnano playground

Additional context

No response

@alexander-akait
Copy link
Member

Yeah, it is unsafe, we should provide an option to disable it, I want to keep it true by default, because most of developer use CSS inside custom properties, so it is safe in most of cases

@nex3
Copy link
Contributor Author

nex3 commented Dec 1, 2022

That's fair, but in that case you should probably change the description of cssnano-prefix-default to avoid saying it makes no assumptions. (Probably just enumerating the assumptions it does make is sufficient.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants