garrytan/gstack · error · Error

CSS value rejected: contains potentially dangerous pattern.

Error message

CSS value rejected: contains potentially dangerous pattern.

What it means

Error "CSS value rejected: contains potentially dangerous pattern." thrown in garrytan/gstack.

Source

Thrown at browse/src/cdp-inspector.ts:509

/**
 * Modify a CSS property on an element.
 * Uses CSS.setStyleTexts in headed mode, falls back to inline style in headless.
 */
export async function modifyStyle(
  page: Page,
  selector: string,
  property: string,
  value: string
): Promise<StyleModification> {
  // Validate CSS property name
  if (!/^[a-zA-Z-]+$/.test(property)) {
    throw new Error(`Invalid CSS property name: ${property}. Only letters and hyphens allowed.`);
  }

  // Validate CSS value — block data exfiltration patterns
  const DANGEROUS_CSS = /url\s*\(|expression\s*\(|@import|javascript:|data:/i;
  if (DANGEROUS_CSS.test(value)) {
    throw new Error('CSS value rejected: contains potentially dangerous pattern.');
  }

  let oldValue = '';
  let source = 'inline';
  let sourceLine = 0;
  let method: 'setStyleTexts' | 'inline' = 'inline';

  try {
    // Try CDP approach first
    const session = await getOrCreateSession(page);
    const result = await inspectElement(page, selector);
    oldValue = result.computedStyles[property] || '';

    // Find the most-specific matching rule that has this property
    let targetRule: InspectorResult['matchedRules'][0] | null = null;
    for (const rule of result.matchedRules) {
      if (rule.userAgent) continue;
      const hasProp = rule.properties.some(p => p.name === property);

View on GitHub (pinned to 94993f7401)

When it happens

Trigger: Thrown at browse/src/cdp-inspector.ts:509 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of garrytan/gstack@94993f7401 (2026-08-12). Data as JSON: /api/errors/b1a923bfaceb75dd. Report an issue: GitHub.