postcss 8.5.9 → 8.5.11

package/lib/lazy-result.js

@@ -378,6 +378,16 @@ class LazyResult {
     if (opts.stringifier) str = opts.stringifier
     if (str.stringify) str = str.stringify
 
+    let rootSource = this.result.root.source
+    if (opts.map === undefined && !(rootSource && rootSource.input && rootSource.input.map)) {
+      let result = ''
+      str(this.result.root, i => {
+        result += i
+      })
+      this.result.css = result
+      return this.result
+    }
+
     let map = new MapGenerator(str, this.result.root, this.result.opts)
     let data = map.generate()
     this.result.css = data[0]

package/lib/processor.js

@@ -7,7 +7,7 @@ let Root = require('./root')
 
 class Processor {
   constructor(plugins = []) {
-    this.version = '8.5.9'
+    this.version = '8.5.11'
     this.plugins = this.normalize(plugins)
   }
 

package/lib/stringifier.js

@@ -1,5 +1,17 @@
 'use strict'
 
+// Escapes sequences that could break out of an HTML <style> context.
+// Uses CSS unicode escaping (\3c = '<') which is valid CSS and parsed
+// correctly by all compliant CSS consumers.
+const STYLE_TAG = /(<)(\/?style\b)/gi
+const COMMENT_OPEN = /(<)(!--)/g
+
+function escapeHTMLInCSS(str) {
+  if (typeof str !== 'string') return str
+  if (!str.includes('<')) return str
+  return str.replace(STYLE_TAG, '\\3c $2').replace(COMMENT_OPEN, '\\3c $2')
+}
+
 const DEFAULT_RAW = {
   after: '\n',
   beforeClose: '\n',
@@ -25,11 +37,12 @@ class Stringifier {
   }
 
   atrule(node, semicolon) {
+    let raws = node.raws
     let name = '@' + node.name
     let params = node.params ? this.rawValue(node, 'params') : ''
 
-    if (typeof node.raws.afterName !== 'undefined') {
-      name += node.raws.afterName
+    if (typeof raws.afterName !== 'undefined') {
+      name += raws.afterName
     } else if (params) {
       name += ' '
     }
@@ -37,8 +50,8 @@ class Stringifier {
     if (node.nodes) {
       this.block(node, name + params)
     } else {
-      let end = (node.raws.between || '') + (semicolon ? ';' : '')
-      this.builder(name + params + end, node)
+      let end = (raws.between || '') + (semicolon ? ';' : '')
+      this.builder(escapeHTMLInCSS(name + params + end), node)
     }
   }
 
@@ -72,53 +85,77 @@ class Stringifier {
   }
 
   block(node, start) {
-    let between = this.raw(node, 'between', 'beforeOpen')
-    this.builder(start + between + '{', node, 'start')
+    let raws = node.raws
+    let between = typeof raws.between !== 'undefined'
+      ? raws.between
+      : this.raw(node, 'between', 'beforeOpen')
+    this.builder(escapeHTMLInCSS(start + between) + '{', node, 'start')
 
     let after
     if (node.nodes && node.nodes.length) {
       this.body(node)
-      after = this.raw(node, 'after')
+      after = typeof raws.after !== 'undefined'
+        ? raws.after
+        : this.raw(node, 'after')
     } else {
-      after = this.raw(node, 'after', 'emptyBody')
+      after = typeof raws.after !== 'undefined'
+        ? raws.after
+        : this.raw(node, 'after', 'emptyBody')
     }
 
-    if (after) this.builder(after)
+    if (after) this.builder(escapeHTMLInCSS(after))
     this.builder('}', node, 'end')
   }
 
   body(node) {
-    let last = node.nodes.length - 1
+    let nodes = node.nodes
+    let last = nodes.length - 1
     while (last > 0) {
-      if (node.nodes[last].type !== 'comment') break
+      if (nodes[last].type !== 'comment') break
       last -= 1
     }
 
     let semicolon = this.raw(node, 'semicolon')
-    for (let i = 0; i < node.nodes.length; i++) {
-      let child = node.nodes[i]
-      let before = this.raw(child, 'before')
-      if (before) this.builder(before)
+    let isDocument = node.type === 'document'
+    for (let i = 0; i < nodes.length; i++) {
+      let child = nodes[i]
+      let before = child.raws.before
+      if (typeof before === 'undefined') {
+        before = this.raw(child, 'before')
+      }
+      if (before) this.builder(isDocument ? before : escapeHTMLInCSS(before))
       this.stringify(child, last !== i || semicolon)
     }
   }
 
   comment(node) {
-    let left = this.raw(node, 'left', 'commentLeft')
-    let right = this.raw(node, 'right', 'commentRight')
-    this.builder('/*' + left + node.text + right + '*/', node)
+    let raws = node.raws
+    let left = typeof raws.left !== 'undefined'
+      ? raws.left
+      : this.raw(node, 'left', 'commentLeft')
+    let right = typeof raws.right !== 'undefined'
+      ? raws.right
+      : this.raw(node, 'right', 'commentRight')
+    this.builder(escapeHTMLInCSS('/*' + left + node.text + right + '*/'), node)
   }
 
   decl(node, semicolon) {
-    let between = this.raw(node, 'between', 'colon')
-    let string = node.prop + between + this.rawValue(node, 'value')
+    let raws = node.raws
+    let between = typeof raws.between !== 'undefined'
+      ? raws.between
+      : this.raw(node, 'between', 'colon')
+
+    let rawVal = raws.value
+    let value = rawVal && rawVal.value === node.value ? rawVal.raw : node.value
+
+    let string = node.prop + between + value
 
     if (node.important) {
-      string += node.raws.important || ' !important'
+      string += raws.important || ' !important'
     }
 
     if (semicolon) string += ';'
-    this.builder(string, node)
+    this.builder(escapeHTMLInCSS(string), node)
   }
 
   document(node) {
@@ -154,9 +191,9 @@ class Stringifier {
 
     // Detect style by other nodes
     let root = node.root()
-    if (!root.rawCache) root.rawCache = {}
-    if (typeof root.rawCache[detect] !== 'undefined') {
-      return root.rawCache[detect]
+    let cache = root.rawCache || (root.rawCache = {})
+    if (typeof cache[detect] !== 'undefined') {
+      return cache[detect]
     }
 
     if (detect === 'before' || detect === 'after') {
@@ -175,7 +212,7 @@ class Stringifier {
 
     if (typeof value === 'undefined') value = DEFAULT_RAW[detect]
 
-    root.rawCache[detect] = value
+    cache[detect] = value
     return value
   }
 
@@ -324,13 +361,17 @@ class Stringifier {
 
   root(node) {
     this.body(node)
-    if (node.raws.after) this.builder(node.raws.after)
+    if (node.raws.after) {
+      let after = node.raws.after
+      let isDocument = node.parent && node.parent.type === 'document'
+      this.builder(isDocument ? after : escapeHTMLInCSS(after))
+    }
   }
 
   rule(node) {
     this.block(node, this.rawValue(node, 'selector'))
     if (node.raws.ownSemicolon) {
-      this.builder(node.raws.ownSemicolon, node, 'end')
+      this.builder(escapeHTMLInCSS(node.raws.ownSemicolon), node, 'end')
     }
   }
 

package/lib/tokenize.js

@@ -36,6 +36,7 @@ module.exports = function tokenizer(input, options = {}) {
   let pos = 0
   let buffer = []
   let returned = []
+  let lastBadParen = -1
 
   function position() {
     return pos
@@ -127,11 +128,14 @@ module.exports = function tokenizer(input, options = {}) {
           currentToken = ['brackets', css.slice(pos, next + 1), pos, next]
 
           pos = next
+        } else if (pos <= lastBadParen) {
+          currentToken = ['(', '(', pos]
         } else {
           next = css.indexOf(')', pos + 1)
           content = css.slice(pos, next + 1)
 
           if (next === -1 || RE_BAD_BRACKET.test(content)) {
+            lastBadParen = next === -1 ? length : next
             currentToken = ['(', '(', pos]
           } else {
             currentToken = ['brackets', content, pos, next]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postcss",
-  "version": "8.5.9",
+  "version": "8.5.11",
   "description": "Tool for transforming styles with JS plugins",
   "keywords": [
     "css",