
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
postcss-only-directive
Advanced tools
PostCSS plugin Allows you to easily create entrypoint files which contain only certain rules.
This plugin is designed to help you write CSS for a component in one file, and then split the rules up into separate files based on your needs.
A simple use case would be for creating separate IE stylesheets. Another good use case would be splitting up rules by media query.
We start with a file that has been marked up with @only
directives:
/* _component.scss */
.button {
background: blue;
@only(ie) { content: 'ie only'; }
}
@only(medium) {
@media(min-width: 500px) {
.button { background: green; }
}
}
@only(large) {
@media(min-width: 900px) {
.button { background: red; }
}
}
Then we call the @onlyRender
directive at the top of each file to specify what should be included.
/* ie.scss */
@onlyRender(ie);
@import 'component'; // inlines the css
/* ie.css */
.button { content: 'ie only'; }
/* medium-and-up.scss */
@onlyRender(medium, large);
@import 'component'; // inlines the css
/* medium-and-up.css */
@media(min-width: 500px) {
.button { background: green; }
}
@media(min-width: 900px) {
.button { background: red; }
}
/* small.scss */
@onlyRender(:root);
@import 'component'; // inlines the css
/* small.css */
.button { background: blue; }
/* app.scss */
@onlyRender(:all);
@import 'component'; // inlines the css
/* app.css */
.button {
background: blue;
content: 'ie only';
}
@media(min-width: 500px) {
.button { background: green; }
}
@media(min-width: 900px) {
.button { background: red; }
}
postcss([ require('postcss-only-directive')({ whitelist: [] }) ])
See PostCSS docs for examples for your environment.
The whitelist
is a list of strings specifying which @only
directives will be supported. Any rules not in a
whitelist will be rolled into :root
by default.
Suppose I'm splitting a file out for IE:
/* button.css */
.button { background: blue; }
@only(ie11) { .button { background: green; } }
/* main.css */
@onlyRender(:root);
@import 'button';
/* ie11.css */
@onlyRender(ie11);
@import 'button';
Now pretend that someone comes along later and adds an @only(ie10)
rule - not realizing that no one has created a
matching call to @onlyRender(ie10)
. Their rules will be removed from our stylesheets silently!
The whitelist is here to save us from that. Any rules that aren't in the whitelist will be automatically rolled up into
the special :root
keyword, avoiding lossy changes.
There has been a lot of talk about ways to accomplish this over on the sass project on github. There was a lot of
discussion on https://github.com/sass/sass/issues/241, and then @meefox proposed the @only
directive in
https://github.com/sass/sass/issues/1187.
There are some other postcss plugins that do similar things:
These generally didn't fit my needs because they emit files outside of the normal build pipeline. These files have to be manually minified, gzipped, digested / etc.
Complicating my pipeline like that wasn't an option for me, so I chose this approach. The tradeoff is that you must specify the files ahead of time. Other media-query splitters can dynamically generate files based on the CSS itself - this plugin does not give you that option.
FAQs
PostCSS plugin Allows you to easily create entrypoint files which contain only certain rules.
The npm package postcss-only-directive receives a total of 2 weekly downloads. As such, postcss-only-directive popularity was classified as not popular.
We found that postcss-only-directive demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.