fix(lit): replace unsafeCSS with CSSStyleSheet for structural styles#633
Conversation
There was a problem hiding this comment.
Code Review
This pull request effectively addresses the security concern of using unsafeCSS by replacing it with the safer CSSStyleSheet API. The implementation is solid, with a good fallback for environments where CSSStyleSheet is not supported. I have one suggestion to improve debuggability by logging potential errors during stylesheet creation.
There was a problem hiding this comment.
I left some comments, and I think @ava-cassiopeia should have final say, but this looks good to me! Thanks for the fix!
(I'm also modifying the description of this PR to link it to the issue about removing unsafeCSS)
ava-cassiopeia
left a comment
There was a problem hiding this comment.
This generally LGTM, but I think @ditman has some solid points, so I'll wait to approve until those are addressed.
|
hi @ava-cassiopeia @ditman could you please review, made the required changes |
ava-cassiopeia
left a comment
There was a problem hiding this comment.
Thanks for iterating on this, and thanks for your contributions!
This PR removes
unsafeCSSusage from the Lit renderer to fix internal build policy failures reported in issue #462.Specifically, in
renderers/lit/src/0.8/ui/styles.ts,unsafeCSS(Styles.structuralStyles)was replaced with a safer stylesheet construction flow:CSSStyleSheetStyles.structuralStylesusingreplaceSync[]as a fallback whenCSSStyleSheetis unavailable or failsThis preserves behavior (shared structural styles still applied) while eliminating direct
unsafeCSSusage.Fixes: #462
Pre-launch Checklist