fix: prevent universal selector leakage in getStyl#582
Conversation
majestic-owl448
left a comment
majestic-owl448
left a comment
There was a problem hiding this comment.
Thanks for the PR. The core fix looks good, but the getStyleAny tests don't actually verify the universal selector guard.
In the three getStyleAny tests, the queried selectors (span[class~="one"] :first-of-type, span[class~="one"] p:first-of-type, span[class~="one"] p:first-of-type) don't exist anywhere in the CSS fixture. That means getStyle returns null for them via a plain exact-match miss, not because of the universal selector guard. The tests would pass even without the fix.
To properly test getStyleAny, the fixture needs a scenario where the bug would reproduce: a rule whose selectorText contains *, and a query that omits * but would otherwise match. The test should fail without the fix and pass with it.
Please also add the fixture and tests for the remaining cases (want *, CSS has no *; don't want *, CSS has no *) to mirror the four combinations already tested in getStyle.
Previously the guard (ruleHasUniversal && !wantsUniversal) could never change getStyle's outcome because exact selectorText matching already guaranteed that a string with * and one without * could never be equal. JSDOM preserves * verbatim in selectorText, so the guard was unreachable. Add _normalizeUniversal() to strip the universal type selector (* at the start or after a combinator) before comparing, so a CSS rule written as `span *:first-of-type` can be matched by the query `span *:first-of-type` but is blocked by the guard when the query omits *, e.g. `span :first-of-type`. Expand getStyleAny tests to mirror the four combinations already in getStyle: - want *, CSS has * → truthy - want *, CSS has no * → null - don't want *, CSS has * → null (guard exercises the fix) - don't want *, CSS has no * → truthy / null The "should not match * rules against non-* selectors" test now fails without the fix and passes with it, satisfying the reviewer's requirement.
laasya2005
force-pushed
the
fix/universal-selector-leakage
branch
from
f400800 to
af5a35c
Compare
2 participants
Update index.md)Closes freeCodeCamp/freeCodeCamp#64218
CSS rules using universal selectors (
*) likespan[class~="one"] *:first-of-typecould match queries for specific selectors that did not include*, causing overly broad student CSS to incorrectly pass challenge validation.Changes:
_selectorHasUniversal()to detect*in CSS selectorsgetStyle()to skip rules containing*when the queried selector does not use it