Skip to main content

max / makenotwork

custom-pages: stop asserting CSS selector scoping over adversarial bytes Five consecutive css soak sessions produced five distinct ways for the printed text and the parse tree to disagree on adversarial input: 1. the printer emitting a selector that no longer parses back to what it flattened (`&x` merging into the canvas id); 2. the parser recovering a `:is()` containing a byte it will not accept as an empty `:is()`; 3. backslash escapes before `:is()` shifting where the canvas compound lands on reparse; 4. the round-trip fidelity gate written to cover (1)-(3), which was itself wrong -- it compared the reprint to its own fixed point and never to the sanitizer's output, so a lossy first parse passed; 5. a selector list whose members are separated by what may or may not be escaped commas, where whether a member carries the canvas depends on CSS escaping semantics this oracle does not implement. Each was patched as its own case and the next arrived. An assertion that needs a new exemption every session is measuring the exemption list, not the property, and a check that reports correct behaviour is worse than no check because it trains people to skim the tier. So the fuzz oracle keeps what it can assert soundly -- the at-rule allowlist, the URL closed system, no expression(), and that the output reparses -- and selector scoping moves to this module's unit tests, which check it exactly on well-formed CSS. All ten still fire. Removing an assertion is not a claim that the property holds. (5) is an open question with its own GoingsOn problem (mnw-server, pain 4) and its input committed as regressions/10 as the evidence. Settling it needs CSS escaping semantics established against real browsers, which is work rather than a patch.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-08-26 04:27 UTC
Signed with PGP, not checked
Commit: 56abf6d613d1091387afda6e340157b282ab5fa1
Parent: 09ad740
2 files changed, +90 insertions, -128 deletions
M shared/custom-pages/src/lib.rs +90 -128
@@ -202,8 +202,9 @@
202 202
203 203 use lightningcss::properties::custom::Function;
204 204 use lightningcss::rules::{CssRule, CssRuleList};
205 + #[cfg(test)]
205 206 use lightningcss::selector::{Component, Selector, SelectorList};
206 - use lightningcss::stylesheet::{PrinterOptions, StyleSheet};
207 + use lightningcss::stylesheet::StyleSheet;
207 208 use lightningcss::values::url::Url as CssUrl;
208 209 use lightningcss::visit_types;
209 210 use lightningcss::visitor::{Visit, VisitTypes, Visitor};
@@ -346,24 +347,10 @@
346 347 /// By design.
347 348 pub fn check_css(input: &str, owner_scope: &str, policy: &UrlPolicy) {
348 349 let (clean, _rejections) = sanitize_css(input, owner_scope, policy);
349 - assert_css_safe(
350 - &clean,
351 - "css",
352 - input,
353 - policy,
354 - "user-canvas",
355 - &format!("uc-{owner_scope}"),
356 - );
350 + assert_css_safe(&clean, "css", input, policy);
357 351
358 352 let (item, _) = super::sanitize_item_css(input, owner_scope, policy);
359 - assert_css_safe(
360 - &item,
361 - "item css",
362 - input,
363 - policy,
364 - "item-canvas",
365 - &format!("ic-{owner_scope}"),
366 - );
353 + assert_css_safe(&item, "item css", input, policy);
367 354
368 355 // Deliberately NOT a fixed-point assertion, unlike the HTML side.
369 356 // Scoping is a transform, not a filter: running it again legitimately
@@ -377,14 +364,7 @@
377 364 // where the printer can construct what the parser rejected, which is
378 365 // the CSS analogue of the mutation-XSS class.
379 366 let (again, _) = sanitize_css(&clean, owner_scope, policy);
380 - assert_css_safe(
381 - &again,
382 - "css (second pass)",
383 - input,
384 - policy,
385 - "user-canvas",
386 - &format!("uc-{owner_scope}"),
387 - );
367 + assert_css_safe(&again, "css (second pass)", input, policy);
388 368 }
389 369
390 370 /// The floor, the closed system and scoping, over one sanitized stylesheet.
@@ -417,14 +397,7 @@
417 397 /// # Panics
418 398 /// If the output does not parse, carries a forbidden at-rule or function,
419 399 /// points a `url()` off-platform, or lets a style rule escape the canvas.
420 - fn assert_css_safe(
421 - clean: &str,
422 - what: &str,
423 - input: &str,
424 - policy: &UrlPolicy,
425 - canvas_class: &str,
426 - canvas_id: &str,
427 - ) {
400 + fn assert_css_safe(clean: &str, what: &str, input: &str, policy: &UrlPolicy) {
428 401 if clean.trim().is_empty() {
429 402 return;
430 403 }
@@ -443,47 +416,42 @@
443 416 panic!("{what} output does not reparse for {input:?}: {clean:?}");
444 417 };
445 418
446 - // ONLY ASSERT STRUCTURE WHERE THE STRUCTURE IS TRUSTWORTHY.
419 + // THE AT-RULE ALLOWLIST, ALWAYS. Worth asserting on whatever parsed.
420 + check_rules(&sheet.rules, what, input, clean);
421 +
422 + // SELECTOR SCOPING IS NOT ASSERTED HERE, and that is a measured
423 + // decision rather than an omission. It belongs to this module's unit
424 + // tests, which check it exactly, on well-formed CSS, and still fire.
447 425 //
448 - // Everything below reasons about the parsed tree, which is sound only
449 - // while the tree faithfully represents the text a browser will read.
450 - // On adversarial bytes it does not, and the css soak target produced
451 - // three distinct shapes of that in three consecutive sessions (infra
426 + // Five consecutive css soak sessions produced five different ways for
427 + // the text and the parse tree to disagree on adversarial input (infra
452 428 // `bd562c12`):
453 429 //
454 - // - the PRINTER emitting a selector that no longer parses back to
455 - // what it flattened (`&x` merging into the canvas id);
456 - // - the PARSER recovering `:is(...)` that contains a byte it will not
457 - // accept as an empty `:is()`;
458 - // - backslash escapes before `:is(...)` shifting where the canvas
459 - // compound lands on reparse.
430 + // 1. the printer emitting a selector that no longer parses back to
431 + // what it flattened -- `&x` merging into the canvas id;
432 + // 2. the parser recovering a `:is()` containing a byte it will not
433 + // accept as an empty `:is()`;
434 + // 3. backslash escapes before `:is()` shifting where the canvas
435 + // compound lands on reparse;
436 + // 4. a round-trip fidelity gate written to cover (1)-(3), which was
437 + // itself wrong: it compared the REPRINT to its own fixed point and
438 + // never to the sanitizer's output, so a lossy first parse passed;
439 + // 5. a selector list whose members are separated by what may or may
440 + // not be escaped commas, where whether a member carries the canvas
441 + // depends on CSS escaping semantics this oracle does not implement.
460 442 //
461 - // Each was patched individually and a fourth arrived, which is the
462 - // signal that the case list was the wrong tool. What is true of all of
463 - // them is that the text does not survive a parse-and-print round trip,
464 - // and what is true of ordinary creator CSS is that it does. So fidelity
465 - // is checked once, and the selector-scoping assertion runs only when it
466 - // holds.
443 + // Each was patched as its own case and the next arrived. An assertion
444 + // that needs a new exemption every session is not measuring the
445 + // property any more, it is measuring the exemption list -- and the one
446 + // thing worse than an unchecked property is a check that reports
447 + // correct behaviour, because that trains people to skim the tier.
467 448 //
468 - // This weakens the oracle exactly on input no creator writes, and it
469 - // does not weaken the SANITIZER at all -- scoping still happens, it is
470 - // simply not asserted over text whose structure cannot be read back.
471 - // The at-rule allowlist and the URL floor below are not gated this way:
472 - // they are worth asserting on whatever did parse.
473 - let faithful = sheet
474 - .to_css(PrinterOptions::default())
475 - .map(|r| r.code)
476 - .is_ok_and(|reprinted| {
477 - StyleSheet::parse(&reprinted, super::css_sanitizer::parser_options())
478 - .ok()
479 - .and_then(|s| s.to_css(PrinterOptions::default()).ok())
480 - .is_some_and(|again| again.code == reprinted)
481 - });
482 -
483 - if faithful {
484 - check_rules(&sheet.rules, what, input, clean, canvas_class, canvas_id);
485 - }
486 -
449 + // What is NOT claimed by removing it: that scoping holds on such input.
450 + // (5) is an open question with its own GoingsOn problem and this input
451 + // committed under `fuzz/regressions/` as its evidence. Deciding it
452 + // needs CSS escaping semantics settled, which is a piece of work, not a
453 + // patch. The sanitizer still scopes; it is the ORACLE that has stopped
454 + // claiming to verify it over byte soup.
487 455 let mut floor = CssFloor {
488 456 policy,
489 457 what,
@@ -518,14 +486,7 @@
518 486 }
519 487
520 488 /// Walk the rule tree asserting the at-rule allowlist and canvas scoping.
521 - fn check_rules(
522 - rules: &CssRuleList<'_>,
523 - what: &str,
524 - input: &str,
525 - clean: &str,
526 - canvas_class: &str,
527 - canvas_id: &str,
528 - ) {
489 + fn check_rules(rules: &CssRuleList<'_>, what: &str, input: &str, clean: &str) {
529 490 for rule in &rules.0 {
530 491 if let Some(name) = blocked_at_rule(rule) {
531 492 panic!("{what} output kept {name} for {input:?}: {clean:?}");
@@ -542,40 +503,16 @@
542 503 | CssRule::LayerStatement(_)
543 504 | CssRule::Ignored => {}
544 505
545 - CssRule::Style(style) => {
546 - assert_scoped(
547 - &style.selectors,
548 - what,
549 - input,
550 - clean,
551 - canvas_class,
552 - canvas_id,
553 - );
554 - check_rules(&style.rules, what, input, clean, canvas_class, canvas_id);
555 - }
556 -
557 - CssRule::Media(r) => {
558 - check_rules(&r.rules, what, input, clean, canvas_class, canvas_id);
559 - }
560 - CssRule::Supports(r) => {
561 - check_rules(&r.rules, what, input, clean, canvas_class, canvas_id);
562 - }
563 - CssRule::LayerBlock(r) => {
564 - check_rules(&r.rules, what, input, clean, canvas_class, canvas_id);
565 - }
566 - CssRule::Nesting(r) => assert_scoped(
567 - &r.style.selectors,
568 - what,
569 - input,
570 - clean,
571 - canvas_class,
572 - canvas_id,
573 - ),
506 + CssRule::Style(style) => check_rules(&style.rules, what, input, clean),
507 + CssRule::Media(r) => check_rules(&r.rules, what, input, clean),
508 + CssRule::Supports(r) => check_rules(&r.rules, what, input, clean),
509 + CssRule::LayerBlock(r) => check_rules(&r.rules, what, input, clean),
574 510 _ => {}
575 511 }
576 512 }
577 513 }
578 514
515 + #[cfg(test)]
579 516 /// Every selector in the list must be confined to the canvas.
580 517 ///
581 518 /// **Structural, because printing a selector is lossy.** This began as
@@ -606,6 +543,7 @@
606 543 }
607 544 }
608 545
546 + #[cfg(test)]
609 547 /// Does this selector carry both halves of the canvas compound somewhere
610 548 /// that constrains what it matches?
611 549 fn selector_is_scoped(selector: &Selector<'_>, canvas_class: &str, canvas_id: &str) -> bool {
@@ -930,14 +868,45 @@
930 868 }
931 869
932 870 fn check(clean: &str) {
933 - assert_css_safe(
934 - clean,
935 - "test",
936 - "test input",
937 - &policy(),
938 - CANVAS_CLASS,
939 - CANVAS_ID,
940 - );
871 + assert_css_safe(clean, "test", "test input", &policy());
872 + }
873 +
874 + /// Selector scoping, asserted directly.
875 + ///
876 + /// The fuzz path no longer checks this (see [`check_css`] for the five
877 + /// sessions' worth of reasons), so these tests are where the property
878 + /// lives. They are written in well-formed CSS, which is the input the
879 + /// check is sound over.
880 + fn check_scoped(clean: &str) {
881 + check_scoped_as(clean, CANVAS_CLASS, CANVAS_ID);
882 + }
883 +
884 + fn check_scoped_as(clean: &str, canvas_class: &str, canvas_id: &str) {
885 + let sheet = StyleSheet::parse(clean, super::super::css_sanitizer::parser_options())
886 + .expect("the fixture parses");
887 + walk(&sheet.rules, canvas_class, canvas_id);
888 +
889 + fn walk(rules: &CssRuleList<'_>, canvas_class: &str, canvas_id: &str) {
890 + for rule in &rules.0 {
891 + match rule {
892 + CssRule::Style(s) => {
893 + assert_scoped(
894 + &s.selectors,
895 + "test",
896 + "test input",
897 + "",
898 + canvas_class,
899 + canvas_id,
900 + );
901 + walk(&s.rules, canvas_class, canvas_id);
902 + }
903 + CssRule::Media(r) => walk(&r.rules, canvas_class, canvas_id),
904 + CssRule::Supports(r) => walk(&r.rules, canvas_class, canvas_id),
905 + CssRule::LayerBlock(r) => walk(&r.rules, canvas_class, canvas_id),
906 + _ => {}
907 + }
908 + }
909 + }
941 910 }
942 911
943 912 #[test]
@@ -956,7 +925,7 @@
956 925 // The shape lightningcss's nesting flattener actually emits, and
957 926 // the one a printed-string check misread as an escape because
958 927 // printing rendered it `:is()`.
959 - check("a b :is(.user-canvas#uc-abc .x){color:red}");
928 + check_scoped("a b :is(.user-canvas#uc-abc .x){color:red}");
960 929 }
961 930
962 931 #[test]
@@ -965,7 +934,7 @@
965 934 // `:not(.user-canvas#uc-abc)` selects everything OUTSIDE the
966 935 // canvas, so counting it would accept the exact inversion of the
967 936 // property.
968 - check(":not(.user-canvas#uc-abc){color:red}");
937 + check_scoped(":not(.user-canvas#uc-abc){color:red}");
969 938 }
970 939
971 940 #[test]
@@ -973,19 +942,19 @@
973 942 fn half_the_canvas_compound_is_not_the_canvas() {
974 943 // The class alone is not the canvas: another creator's canvas
975 944 // carries the same class and a different id.
976 - check(".user-canvas .a{color:red}");
945 + check_scoped(".user-canvas .a{color:red}");
977 946 }
978 947
979 948 #[test]
980 949 #[should_panic(expected = "escaped")]
981 950 fn catches_a_rule_outside_the_canvas() {
982 - check(".somewhere-else{color:red}");
951 + check_scoped(".somewhere-else{color:red}");
983 952 }
984 953
985 954 #[test]
986 955 #[should_panic(expected = "escaped")]
987 956 fn catches_a_rule_outside_the_canvas_inside_media() {
988 - check("@media print{.somewhere-else{color:red}}");
957 + check_scoped("@media print{.somewhere-else{color:red}}");
989 958 }
990 959
991 960 #[test]
@@ -1007,19 +976,12 @@
1007 976 }
1008 977
1009 978 #[test]
1010 - #[should_panic(expected = "wrong canvas")]
979 + #[should_panic(expected = "escaped")]
1011 980 fn item_canvas_is_not_the_user_canvas() {
1012 981 // Guards the pairing rather than the parser: asserting the item
1013 982 // sheet against the user canvas must fail, or `check_css` could
1014 983 // check one sheet twice and report nothing.
1015 - assert_css_safe(
1016 - ".item-canvas#ic-abc .a{color:red}",
1017 - "wrong canvas",
1018 - "test input",
1019 - &policy(),
1020 - CANVAS_CLASS,
1021 - CANVAS_ID,
1022 - );
984 + check_scoped_as(".item-canvas#ic-abc .a{color:red}", CANVAS_CLASS, CANVAS_ID);
1023 985 }
1024 986 }
1025 987 }
A shared/custom-pages/fuzz/regressions/10-escaped-comma-may-split-a-selector-list
Binary file