From d8f6735e87136cf5caa658642ebb2adf72e09128 Mon Sep 17 00:00:00 2001 From: Connor McEntee Date: Sun, 9 Nov 2025 05:41:23 -0700 Subject: [PATCH 1/2] fix: use base64url encoding to prevent path normalization corruption MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Base64-encoded CSS data in virtual file paths as the source query parameter can contain `/` and `//` characters, which are susceptible to path normalization in bundler plugin systems. While the source parameter should be opaque it is not URL safe and esbuild configurations can collapse `//` → `/`, which corrupts the base64 data preventing compressed source data from being read. Switching to base64url encoding replaces `/` with `_` and `+` with `-`, making the encoded data safe for use in file paths and resilient to this class of error. --- packages/integration/src/serialize.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/integration/src/serialize.ts b/packages/integration/src/serialize.ts index 0617e27e2..4214c90a5 100644 --- a/packages/integration/src/serialize.ts +++ b/packages/integration/src/serialize.ts @@ -12,20 +12,20 @@ export async function serializeCss(source: string): Promise { if (source.length > compressionThreshold) { const compressedSource = await zip(source); - return compressionFlag + compressedSource.toString('base64'); + return compressionFlag + compressedSource.toString('base64url'); } - return Buffer.from(source, 'utf-8').toString('base64'); + return Buffer.from(source, 'utf-8').toString('base64url'); } export async function deserializeCss(source: string): Promise { if (source.indexOf(compressionFlag) > -1) { const decompressedSource = await unzip( - Buffer.from(source.replace(compressionFlag, ''), 'base64'), + Buffer.from(source.replace(compressionFlag, ''), 'base64url'), ); return decompressedSource.toString('utf-8'); } - return Buffer.from(source, 'base64').toString('utf-8'); + return Buffer.from(source, 'base64url').toString('utf-8'); } From a674f56f2f721af38f184dfe20174d4c1ed78743 Mon Sep 17 00:00:00 2001 From: Connor McEntee Date: Sun, 9 Nov 2025 05:59:18 -0700 Subject: [PATCH 2/2] add changeset --- .changeset/honest-lamps-complain.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/honest-lamps-complain.md diff --git a/.changeset/honest-lamps-complain.md b/.changeset/honest-lamps-complain.md new file mode 100644 index 000000000..9bc0381bb --- /dev/null +++ b/.changeset/honest-lamps-complain.md @@ -0,0 +1,5 @@ +--- +'@vanilla-extract/integration': patch +--- + +base64url encode generated CSS source to avoid errors in virtual file paths