Robustness : fix a case where tokenizer state is broken

[abarre]

Our solution minifies CSS from various websites and some CSS have "corrupted CSS portion". One case completely breaks the tokenizer state and destroy all URL in the CSS file.

If a corrupted CSS portion contains a ), the variable roundBracketLevel will be -1. Then, all URL in the rest of the file won't be correctly parsed and will be deleted.

The patch I found is adding a line that states that roundBracketLevel is always a positive integer in the for loop that parse the CSS code :

roundBracketLevel = Math.max(roundBracketLevel, 0);

Environment

• clean-css version - npm ls clean-css: clean-css@4.1.9
• node.js version - node -v: v8.9.4
• operating system: Mac OS

Configuration options

var CleanCSS = require('clean-css');
new CleanCSS({
level: { 1: {all:false}}
})

Input CSS

.a{background-image:url('bg-buttonh.png'); }
'/imagerie/booking/common/bg-buttonh.png');}
.c{background:url(/carte-bienvenue/bg.jpg)}
.e{background:url(/carte-bienvenue/bg2.jpg)}

Actual output CSS

a{background-image:url(bg-buttonh.png)}'/imagerie/booking/common/bg-buttonh.png')}.c{}.e{}

Expected output CSS

a{background-image:url(bg-buttonh.png)}'/imagerie/booking/common/bg-buttonh.png')}.c{background:url(/carte-bienvenue/bg.jpg)}.e{background:url(/carte-bienvenue/bg2.jpg)}

[jakubpawlowicz]

Hey @abarre. Thanks for coming back to report the issue - your solution seems right and straightforward to implement. Would you send a PR?

[jakubpawlowicz]

Thanks @abarre - I've merged it to master and 4.1 due in 4.1.10 soon.

[jakubpawlowicz]

Fixed in 4.1.10.