Merge branch 'main' of github.com:GoogleChromeLabs/critters into secu…

…rity-fixes3
GoogleChromeLabs · Feb 23, 2024 · 1230a9f · 1230a9f
2 parents 2286167 + 2e8cbe8
commit 1230a9f
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 11,362 deletions.
diff --git a/packages/critters/src/css.js b/packages/critters/src/css.js
@@ -199,8 +199,8 @@ function filterSelectors(predicate) {
   }
 }
 
-const MEDIA_TYPES = ['all', 'print', 'screen', 'speech'];
-const MEDIA_KEYWORDS = ['and', 'not', ','];
+const MEDIA_TYPES = new Set(['all', 'print', 'screen', 'speech']);
+const MEDIA_KEYWORDS = new Set(['and', 'not', ',']);
 const MEDIA_FEATURES = [
   'width',
   'aspect-ratio',
@@ -217,9 +217,9 @@ function validateMediaType(node) {
   const { type: nodeType, value: nodeValue } = node;
 
   if (nodeType === 'media-type') {
-    return MEDIA_TYPES.includes(nodeValue);
+    return MEDIA_TYPES.has(nodeValue);
   } else if (nodeType === 'keyword') {
-    return MEDIA_KEYWORDS.includes(nodeValue);
+    return MEDIA_KEYWORDS.has(nodeValue);
   } else if (nodeType === 'media-feature') {
     return MEDIA_FEATURES.some((feature) => {
       return (
@@ -241,20 +241,21 @@ function validateMediaType(node) {
  * is HTML safe and does not cause any injection issue
  */
 export function validateMediaQuery(query) {
-  console.log(query);
   const mediaTree = mediaParser(query);
-  const nodeTypes = ['media-type', 'keyword', 'media-feature'];
+  const nodeTypes = new Set(['media-type', 'keyword', 'media-feature']);
 
   const stack = [mediaTree];
 
   while (stack.length > 0) {
     const node = stack.pop();
 
-    if (nodeTypes.includes(node.type) && !validateMediaType(node)) {
+    if (nodeTypes.has(node.type) && !validateMediaType(node)) {
       return false;
     }
 
-    stack.push(...(node.nodes || []));
+    if (node.nodes) {
+      stack.push(...node.nodes);
+    }
   }
 
   return true;

diff --git a/packages/critters/src/util.js b/packages/critters/src/util.js
@@ -41,6 +41,5 @@ export function createLogger(logLevel) {
 }
 
 export function isSubpath(basePath, currentPath) {
-  const relative = path.relative(basePath, currentPath);
-  return relative && !relative.startsWith('..') && !path.isAbsolute(relative);
+  return !path.relative(basePath, currentPath).startsWith('..');
 }