postcss - npm Package Compare versions

Comparing version 8.5.11 to 8.5.12

lib/postcss.d.ts

@@ -354,2 +354,7 @@ import { RawSourceMap, SourceMapGenerator } from 'source-map-js'
     to?: string
+
+    /**
+     * Disable source map file protections.
+     */
+    unsafeMap?: boolean
   }
@@ -356,0 +361,0 @@

lib/previous-map.js

@@ -19,2 +19,3 @@ 'use strict'
     if (opts.map === false) return
+    if (opts.unsafeMap) this.unsafeMap = true
     this.loadAnnotation(css)
@@ -34,3 +35,3 @@ this.inline = this.startWith(this.annotation, 'data:')
     if (!this.consumerCache) {
-      this.consumerCache = new SourceMapConsumer(this.text)
+      this.consumerCache = new SourceMapConsumer(this.json || this.text)
     }
@@ -88,3 +89,9 @@ return this.consumerCache
 
-  loadFile(path) {
+  loadFile(path, cssFile, trusted) {
+    /* c8 ignore next 5 */
+    if (!trusted && !this.unsafeMap) {
+      if (!/\.map$/i.test(path)) {
+        return undefined
+      }
+    }
     this.root = dirname(path)
@@ -106,3 +113,3 @@ if (existsSync(path)) {
         if (prevPath) {
-          let map = this.loadFile(prevPath)
+          let map = this.loadFile(prevPath, file, true)
           if (!map) {
@@ -131,3 +138,12 @@ throw new Error(
       if (file) map = join(dirname(file), map)
-      return this.loadFile(map)
+      let unknown = this.loadFile(map, file, false)
+      if (unknown) {
+        try {
+          /* c8 ignore next 4 */
+          this.json = JSON.parse(unknown.replace(/^\)]}'[^\n]*\n/, ''))
+        } catch {
+          return undefined
+        }
+      }
+      return unknown
     }
@@ -134,0 +150,0 @@ }

lib/processor.js

@@ -10,3 +10,3 @@ 'use strict'
   constructor(plugins = []) {
-    this.version = '8.5.11'
+    this.version = '8.5.12'
     this.plugins = this.normalize(plugins)
@@ -13,0 +13,0 @@ }

package.json

 {
   "name": "postcss",
-  "version": "8.5.11",
+  "version": "8.5.12",
   "description": "Tool for transforming styles with JS plugins",
@@ -5,0 +5,0 @@ "keywords": [

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

205880

0.27%

Lines of code

7077

0.28%

No dependency changes