<!--- STOP! Before you open an issue please search this repository's issues to see if it has already been reported. This helps reduce duplicate issues from being created. --> <!--- SECURITY DISCLOSURE: If this is a security disclosure please follow the guidelines in CONTRIBUTING.md. This helps keep folks from accidentally releasing vulnerabilities before the maintainers get a chance to fix the issue. --> ### Expected Behaviour Comments are properly ignored in all places. ### Actual Behaviour Comment in the selector that contains a `{` break the parsing because the `{` evaluation is done before the comment escaping. #### Steps to Reproduce - Change the file `test/cases/comment/input.css` by: ``` /* 1 */ head, /* footer, */body/*, nav */ { /* 2 */ /* 3 */ /**/foo: 'bar'; /* 4 */ } /* 5 */ /* 6 */ ``` - Run `yarn test` #### Logs taken while reproducing the problem ``` $jest PASS test/parse.test.ts FAIL test/cases.test.ts ● cases/comment › should match ast.json input.css:3:37: property missing ':' 77 | 78 | function error(msg: string) { > 79 | const err = new CssParseError( | ^ 80 | options?.source || '', 81 | msg, 82 | lineno, at error (src/parse/index.ts:79:17) at declaration (src/parse/index.ts:263:14) at declarations (src/parse/index.ts:294:20) at rule (src/parse/index.ts:716:21) at rules (src/parse/index.ts:134:71) at stylesheet (src/parse/index.ts:98:23) at parse (src/parse/index.ts:720:20) at parseInput (test/cases.test.ts:39:19) at Object.<anonymous> (test/cases.test.ts:15:19) ``` ### Potential fix - Add a special condition in the regex for the selector to skip the comments. This should not reduce performance or introduce a dos vulnerability. - Change the parsing to skip the comment while doing the parsing.
Activity
jogibear9988 commentedon Mar 17, 2026
should be fixed in #621
jogibear9988 commentedon May 20, 2026
fixed
holblin commentedon May 20, 2026
Fixed in Release 4.5.0