Streaming API

[mnot]

Right now, it appears that using tinycss2 requires feeding the entire CSS file into the parser.

A streaming API (similar to html.parser) would allow applications to avoid buffering and the efficiency/security issues that it brings.

[liZe]

Hi @mnot,

Would you like a parse_stylesheet_generator that only consumes the required part of input to yield the next rule?

similar to html.parser

Do you mean something like HTMLParser? It may not be easy to use given all the different high-level tokens that are possible to get in CSS. There’s nothing as useful as HTML’s starttag and endtag in CSS.

[mnot]

Would you like a parse_stylesheet_generator that only consumes the required part of input to yield the next rule?

That would be good, I think - then you could iterate over rule by rule, correct?

Do you mean something like HTMLParser? It may not be easy to use given all the different high-level tokens that are possible to get in CSS. There’s nothing as useful as HTML’s starttag and endtag in CSS.

Yeah, fair enough. Thanks!

[liZe]

That would be good, I think - then you could iterate over rule by rule, correct?

That could iterate over the direct children, mainly qualified rules and at-rules, but not the declarations.

But I don’t think that it’s what you want in mnot/redbot#124. If your goal is to parse URLs, the best way is to write a specific script that goes though the tree manually and finds the URLs where you want (in @import rules, in declaration values, in functions, in variables, etc). See #66 (comment).

For efficiency, what we could do is a lazy API that parses the tokens on demand, but in may be a bit complex and limited. For example:

div {
  color: red;
  a {
    text-decoration: underline;
    font-weight: bold;
  }
  background: blue;
}

Iterating over the div’s block elements will require to consume the a’s block elements before yielding background.

What’s your exact use case, and why is lazy parsing required in this case?

[mnot]

My use case is extracting URLs (without reference to their context) from CSS, for use in an online HTTP resource linter/checker. The requirements are that it not block significantly (running in an event loop that's handling multiple requests) and that it not require buffering the entire response in memory (to avoid exhaustion / attack vectors).

From #66 it sounds like this is non-trivial; my use case is "nice to have" so if it's a lot of work / a bad fit no worries.

Thanks!

[liZe]

My use case is extracting URLs (without reference to their context) from CSS, for use in an online HTTP resource linter/checker. The requirements are that it not block significantly (running in an event loop that's handling multiple requests) and that it not require buffering the entire response in memory (to avoid exhaustion / attack vectors).

OK! It’s currently possible to write a simple script using tinycss2 to get simple URLs in declarations, but it’s probably not possible to catch them all, as some rules allow simple strings (@import is the easiest one), some can be built with CSS variables, or even with HTML attributes (with attr()). If you list URLs for informational purpose, you should be able to get a good script quite easily, but for security purpose it may be much harder. 💪

From #66 it sounds like this is non-trivial; my use case is "nice to have" so if it's a lot of work / a bad fit no worries.

Yes, that would require a lot of work, as tinycss2 is not designed to work this way. Lazy parsing of tokens would only one part of the problem, but we’d also have to add many limits, such as the number of characters in an ident or a string, or number of tokens in a declaration.

But it’s a good idea, we can keep this issue open for the future. If anyone is interested in working on this, don’t hesitate to ping me!