Skip to content

fix(lit): replace unsafeCSS with CSSStyleSheet for structural styles#633

Merged
ava-cassiopeia merged 5 commits intogoogle:mainfrom
iamrajhans:fix-lit-unsafe-css-462
Mar 3, 2026
Merged

fix(lit): replace unsafeCSS with CSSStyleSheet for structural styles#633
ava-cassiopeia merged 5 commits intogoogle:mainfrom
iamrajhans:fix-lit-unsafe-css-462

Conversation

@iamrajhans
Copy link
Contributor

This PR removes unsafeCSS usage from the Lit renderer to fix internal build policy failures reported in issue #462.

Specifically, in renderers/lit/src/0.8/ui/styles.ts, unsafeCSS(Styles.structuralStyles) was replaced with a safer stylesheet construction flow:

  • build a CSSStyleSheet
  • load Styles.structuralStyles using replaceSync
  • return [] as a fallback when CSSStyleSheet is unavailable or fails

This preserves behavior (shared structural styles still applied) while eliminating direct unsafeCSS usage.

Fixes: #462

Pre-launch Checklist

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request effectively addresses the security concern of using unsafeCSS by replacing it with the safer CSSStyleSheet API. The implementation is solid, with a good fallback for environments where CSSStyleSheet is not supported. I have one suggestion to improve debuggability by logging potential errors during stylesheet creation.

Copy link
Collaborator

@ditman ditman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left some comments, and I think @ava-cassiopeia should have final say, but this looks good to me! Thanks for the fix!

(I'm also modifying the description of this PR to link it to the issue about removing unsafeCSS)

Copy link
Collaborator

@ava-cassiopeia ava-cassiopeia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This generally LGTM, but I think @ditman has some solid points, so I'll wait to approve until those are addressed.

@iamrajhans
Copy link
Contributor Author

hi @ava-cassiopeia @ditman could you please review, made the required changes

Copy link
Collaborator

@ava-cassiopeia ava-cassiopeia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for iterating on this, and thanks for your contributions!

@ava-cassiopeia ava-cassiopeia merged commit e2707dd into google:main Mar 3, 2026
8 checks passed
@github-project-automation github-project-automation bot moved this from Todo to Done in A2UI Mar 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

Remove unsafeCSS

3 participants