Our solution minifies CSS from various websites and some CSS have "corrupted CSS portion". One case completely breaks the tokenizer state and destroy all URL in the CSS file.

If a corrupted CSS portion contains a ), the variable roundBracketLevel will be -1. Then, all URL in the rest of the file won't be correctly parsed and will be deleted.

The patch I found is adding a line that states that roundBracketLevel is always a positive integer in the for loop that parse the CSS code :

roundBracketLevel = Math.max(roundBracketLevel, 0);

Environment

• clean-css version - npm ls clean-css: clean-css@4.1.9
• node.js version - node -v: v8.9.4
• operating system: Mac OS

Configuration options

var CleanCSS = require('clean-css');
new CleanCSS({
level: { 1: {all:false}}
})

Input CSS

.a{background-image:url('bg-buttonh.png'); }
'/imagerie/booking/common/bg-buttonh.png');}
.c{background:url(/carte-bienvenue/bg.jpg)}
.e{background:url(/carte-bienvenue/bg2.jpg)}

Actual output CSS

a{background-image:url(bg-buttonh.png)}'/imagerie/booking/common/bg-buttonh.png')}.c{}.e{}

Expected output CSS

a{background-image:url(bg-buttonh.png)}'/imagerie/booking/common/bg-buttonh.png')}.c{background:url(/carte-bienvenue/bg.jpg)}.e{background:url(/carte-bienvenue/bg2.jpg)}