AK-21/Graphite-Industrial-Intelligence

1# postcss-selector-parser [![test](https://github.com/postcss/postcss-selector-parser/actions/workflows/test.yml/badge.svg)](https://github.com/postcss/postcss-selector-parser/actions/workflows/test.yml)2 3> Selector parser with built in methods for working with selector strings.4 5## Install6 7With [npm](https://npmjs.com/package/postcss-selector-parser) do:8 9```10npm install postcss-selector-parser11```12 13## Quick Start14 15```js16const parser = require('postcss-selector-parser');17const transform = selectors => {18    selectors.walk(selector => {19        // do something with the selector20        console.log(String(selector))21    });22};23 24const transformed = parser(transform).processSync('h1, h2, h3');25```26 27To normalize selector whitespace:28 29```js30const parser = require('postcss-selector-parser');31const normalized = parser().processSync('h1, h2, h3', {lossless: false});32// -> h1,h2,h333```34 35Async support is provided through `parser.process` and will resolve a Promise36with the resulting selector string.37 38## API39 40Please see [API.md](API.md).41 42## Security43 44### Selector nesting depth (CVE-2026-9358)45 46The parser walks the selector AST recursively, both when parsing and when47serializing it back to a string (`.toString()`). In versions up to and48including `7.1.1`, a selector with extreme nesting — for example thousands of49nested `:not(...)` — could recurse deeply enough to overflow the call stack and50throw `RangeError: Maximum call stack size exceeded`, a potential51denial-of-service when processing untrusted CSS.52 53This is now bounded by a maximum nesting depth (default: `256`). Beyond that54depth, parsing and serialization throw a regular, catchable `Error` at a55predictable point instead of relying on the runtime hitting its stack limit.56The default is far above any realistic selector, so it does not affect normal57use.58 59**Practical impact is low.** The only attacker-controlled input is the selector60string itself, which is now capped by the default limit. The limit is61adjustable through the `maxNestingDepth` option, but that option is trusted62configuration provided by the integrating code — it is never derived from the63parsed CSS, so a malicious selector cannot change it:64 65```js66// Tighten the limit when parsing untrusted input:67parser().processSync(untrustedSelector, {maxNestingDepth: 128});68```69 70Raising `maxNestingDepth` to a very large value is an explicit, informed choice71and can reintroduce the stack-overflow risk in environments with a small call72stack (e.g. browser workers). The default is recommended unless you have a73specific need.74 75## Credits76 77* Huge thanks to Andrey Sitnik (@ai) for work on PostCSS which helped78  accelerate this module's development.79 80## License81 82MIT83