Security News
Weekly Downloads Now Available in npm Package Search Results
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.
A regex that tokenizes CSS.
var cssTokens = require("css-tokens")
// Tokenize a whole string of CSS:
cssString.match(cssTokens)
// [".foo", "{", "prop", ":", " ", "foo", ";", "}", "\n", ...]
// Rename the class `foo` to `bar`:
cssString.replace(cssTokens, function(token) {
if (token === ".foo") {
token = "bar"
}
return token
})
// [".bar", "{", "prop", ":", " ", "foo", ";", "}", "\n", ...]
npm install css-tokens
var cssTokens = require("css-tokens")
cssTokens
A regex with the g
flag that matches CSS tokens.
The regex always matches, even invalid CSS and the empty string. For
example, cssTokens.exec(string)
never returns null
.
The next match is always directly after the previous. Each token has its own capturing group.
cssTokens.names
An array of names for each token, in the capturing group order.
Unterminated strings are still matched as strings. CSS strings cannot contain (unescaped) newlines, so unterminated strings simply end at the end of the line.
Unterminated multi-line comments are also still matched as comments. They simply go on to the end of the string.
Unterminated unquoted urls are also still matched as unquoted urls. They continue as long as there are valid characters.
Invalid ASCII characters have their own capturing group.
Tokenizing CSS using regexes—in fact, one single regex—won’t be perfect. But that’s not the point either.
@
or .
followed by a single -
Ideally, @-
and .-
(followed by a non-name character) would be matched as
invalid + operator, but they are in fact matched as names. This could be
fixed, but isn’t to simplify the regex. It doesn’t really matter.
Note that #-
is actually allowed by the spec.
The following is hardly a “limitation”, but could be mentioned:
url(http://www.w3.org/2000/svg)
url('http://www.w3.org/2000/svg')
The first line is matched as one single token (unquotedUrl), while the second is matched as four (name + punctuation + string + punctuation). This could be fixed, but isn’t to simplify the regex.
index.js is generated by running node generate-index.js
. The regex is written
in regex.coffee. Don’t worry, you don’t need to know anything about
CoffeeScript: regex.coffee should be kept as simple as possible. CoffeeScript
is only used for its block regexes, which have the following benefits:
RegExp("regex as a string. One backslash: \\\\")
).Everything else is written in JavaScript.
Version 0.2.0 (2014-03-11) ###
Names may now start with @
, #
and .
. This makes it easier to work with
at-rules, ids, classes and hex colors. (Backwards incompatible change.)
Previously those three characters were matched by themselves as punctuation and were followed by names. Now, if any of those characters are on their own (not followed by a name), they’re matched as invalid.
Previously, hex colors were matched as either punctuation + name or
punctuation + number + name. Now they’re always names. (That might not be
ideal, but consider that #f00
is both a valid id and a valid hex color,
which are impossible to distinguish. Think “names of colors”.)
FAQs
A regex that tokenizes CSS.
The npm package css-tokens receives a total of 35 weekly downloads. As such, css-tokens popularity was classified as not popular.
We found that css-tokens demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.
Security News
A Stanford study reveals 9.5% of engineers contribute almost nothing, costing tech $90B annually, with remote work fueling the rise of "ghost engineers."
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.