fix: strip @layer properties block to prevent host page CSS pollution#7685
Conversation
Tailwind v4 emits an `@layer properties` block containing a bare
`*, :before, :after, ::backdrop` selector that resets all `--tw-*`
CSS custom properties on every element of the host page. Because CSS
`@layer` at-rules are globally scoped by the CSS spec, this block
cannot be confined to `#fbjs` and leaks into the host document,
breaking shadows, rings, transforms, and other Tailwind v4 utilities
on any site using the Formbricks SDK.
Add a PostCSS plugin `stripLayerProperties` that removes any
`@layer properties { ... }` block from the compiled CSS output.
The `@property` declarations already present in the same stylesheet
provide the same browser-compatibility fallback for supporting
browsers, so survey rendering is unaffected.
Fixes: formbricks/js#46
WalkthroughThis change updates the PostCSS configuration for the surveys package. The REM_REGEX pattern was modified to use control-character-based boundaries instead of word-boundaries. A new PostCSS plugin called 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/surveys/postcss.config.cjs`:
- Line 57: Add the same postcss marker to remtoEm for consistency: after the
existing stripLayerProperties.postcss = true assignment, set remtoEm.postcss =
true so both plugins (remtoEm and stripLayerProperties) clearly declare
postcss=true; locate the remtoEm variable/assignment in the file and add the
marker there.
- Around line 45-56: The AtRule handler in stripLayerProperties currently
compares atRule.params directly which can fail with surrounding whitespace;
change the check in the layer handler to normalize params (e.g., use
atRule.params.trim()) before comparing to "properties" so that the plugin
reliably removes `@layer` properties even if params include unexpected whitespace;
update the condition inside stripLayerProperties -> AtRule.layer (referencing
atRule and atRule.params) accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: f169f4de-037d-411a-9c75-fd3e0f09e6c1
📒 Files selected for processing (1)
packages/surveys/postcss.config.cjs
|
hey @mariusbolik thanks for this, we'll look into it. In the meantime, pls sign the CLA above |
…fix/surveys-layer-properties-css-pollution
…hanges Remove invisible backspace (0x08) control characters from REM_REGEX in postcss.config.cjs that were left over when \b word boundaries were removed. Revert unrelated cn() test additions from utils.test.ts. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The utils.test.ts revert belongs in PR formbricks#7720, not here. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Rewrite REM_REGEX to use a single character-class quantifier (\d[\d.]*) instead of nested quantifiers (\d+(\.\d+)?) to avoid super-linear backtracking. Resolves SonarCloud security hotspot S5852. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dhruwang
left a comment
There was a problem hiding this comment.
Thanks for the fix, looks good 🚀
Use ([\d.]+) instead of (\d[\d.]*) to eliminate any character overlap between the leading \d and the quantified class. This is the simplest possible form with zero backtracking risk (SonarCloud S5852). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The regex uses a single character-class quantifier on trusted PostCSS input — no backtracking risk. Add NOSONAR comment with rationale. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Can you tell me when this will be live on the hosted version of Formbricks, @Dhruwang? |
|
The problem still occurs in the hosted version. When will it be fixed? |
Problem
surveys.umd.cjsinjects a<style id="formbricks__css">tag intodocument.head. That tag contains two sections:#fbjs *selectors. ✅@layer propertiesblock with bare*, :before, :after, ::backdropselectors. ❌Why it can't be scoped: CSS
@layerat-rules are globally scoped by the CSS specification — they cannot be confined by a surrounding selector. This is a spec constraint, not a browser quirk.Effect: Any host site using Tailwind CSS v4 will have its
--tw-*custom properties reset toinitial/ zero on every element the moment a Formbricks survey initializes. This breaksshadow-*,ring-*,rotate-*,translate-*, and other utilities across the entire page — not just inside the survey widget.Reported in: formbricks/js#46
Fix
Add a small PostCSS plugin in
packages/surveys/postcss.config.cjsthat removes any@layer properties { ... }block from the compiled CSS output:The
@propertydeclarations already emitted earlier in the same stylesheet serve the same browser-compatibility purpose for all supporting browsers. Removing@layer propertiesdoes not affect survey rendering in any browser.Testing
packages/surveysand confirm@layer propertiesis absent fromdist/index.umd.cjs.