Fix minifier silently corrupting/truncating string literals containing URLs, comment-like text, or intentional spacing - #12
Merged
Conversation
…g URLs, comment-like text, or intentional spacing Started an audit of @teloce/bundler (the pieces not already touched by an earlier session's fix for empty build output). minifier/index.ts's JS and CSS minifiers ran plain regexes for comment stripping and whitespace collapsing directly against raw source, with zero awareness of string literals - the same class of bug found repeatedly in @teloce/sfc's parser this session, but here the blast radius is worse: minification runs by default (minify defaults to on) on every `teloce build`, so this could silently corrupt any real component. Confirmed with completely ordinary code, not edge cases: - `const url = "http://example.com/api"; fetch(url)...` - the `//` inside the URL string matched the line-comment regex, deleting everything from that point to the end of the line. Since this was all one line, the closing quote and the entire rest of the statement vanished, leaving `const url = "http:` - an unterminated string literal, a straight SyntaxError that fails to even parse. URLs in string literals are about as common a pattern as JavaScript has. - `const s = "a /* fake comment */ b";` - text inside a string that merely looks like a block comment got stripped out of the string entirely, silently changing its actual content with zero error reported. - `const msg = "Hello World";` - intentional multiple spaces inside a string got collapsed to one, again silently changing what the string contains. - The identical three bugs existed in minifyCSS too: `content: "/* not a comment */"` (a real CSS technique) was reduced to an empty string entirely, and multi-space CSS string content was silently collapsed the same way. Fixed both minifyJavaScript and minifyCSS by replacing the sequence of independent regex passes with a single, proper string-and-comment-aware scan (correctly handling escaped quotes) before any comment removal or whitespace collapsing happens - string contents are now always emitted byte-for-byte untouched, matching the same core technique already used several times this session for @teloce/sfc's parser. The follow-up punctuation-spacing tightening pass (`{ ` -> `{`, ` }` -> `}`, etc.) was similarly rewritten to skip over string literals rather than operate on the whole source blindly. Verified: the URL case now produces valid, correctly minified, executable JavaScript with the URL intact (confirmed by actually running `teloce build` end to end on a real file containing a URL, then executing the resulting output - previously this exact scenario, with minification on by default, produced a SyntaxError); the fake-comment and multi-space string cases are now preserved exactly in both JS and CSS; real comments are still correctly stripped in both; normal punctuation-tightening for actual code is unaffected. Verified: full regression sweep across everything from this session and previous ones still passes, plus a full "pnpm -r build" across the whole workspace with zero errors.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See commit message for full details. minify runs by default on every teloce build - confirmed any string literal containing a URL caused catastrophic truncation (unterminated string, SyntaxError), and fake-comment-looking or multi-spaced string content was silently corrupted, in both JS and CSS minification. Fixed with proper string-aware scanning.