css: bound the payload cloned when splitting target-incompatible selectors - #31913
Open
robobun wants to merge 8 commits into
Open
css: bound the payload cloned when splitting target-incompatible selectors#31913robobun wants to merge 8 commits into
robobun wants to merge 8 commits into
Claude / Claude Code Review
completed
Jun 6, 2026 in 14m 4s
Code review found 1 important issue
Found 5 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/css/rules/mod.rs:1059-1075 |
token_text_len misses Token::Dimension unit text, allowing clone-weight budget bypass |
Annotations
Check failure on line 1075 in src/css/rules/mod.rs
claude / Claude Code Review
token_text_len misses Token::Dimension unit text, allowing clone-weight budget bypass
`token_text_len` has no arm for `Token::Dimension`, so its `unit: &[u8]` falls through to `_ => 0` — prepending a single digit to the PR's own 449 KB → 1 GB repro (`--p: 1aaaa…`) turns the 32 KB `Ident` into a 32 KB-unit `Dimension`, dropping the per-token weight ~2000× and bypassing the new 64 MB cap while output still compounds to gigabytes. The same gap exists in `token_list()` for `TokenOrValue::DashedIdent` (`--p: --aaaa…`) and `TokenOrValue::Url` (`--p: url(aaaa…)`), which also carry input
Loading