/** * Sanitize a CSS property *value* before it is written into a style rule. * * Transformations applied (in order): * 1. Strip null bytes (`\u0000`) — can confuse CSS parsers across environments. * 2. Truncate at the first `{` or `}` character — prevents rule injection. * Example: `"red}body{background:evil"` → `"red"`. * 3. Strip dangerous URL protocols inside `url(...)` — removes `javascript:`, * `vbscript:`, and `data:text/html` (case-insensitive) from url() arguments. * Example: `url("javascript:evil")` → `url("evil")`. * * Safe values such as `calc(100% - 2px)`, `url("https://…")`, * `url(data:image/png;base64,…)`, multi-stop gradients, `var(--x, fallback)`, * and semicolons are passed through without modification. */ export declare function sanitizeValue(value: string): string; /** * Validate a CSS property *name*. * * Returns `true` when the name contains only ASCII letters and hyphens, which * covers all standard CSS properties (e.g. `color`, `background-color`, * `--my-custom-prop`) as well as camelCase variants used by the serializer * (e.g. `backgroundColor`, `fontSize`). * * Returns `false` for anything containing digits, braces, semicolons, colons, * or other characters that have no place in a property name — these are skipped * with a console warning in the serializer, preventing malformed rules such as * `color:red: …` or `font}size: …` from being written into the stylesheet. */ export declare function sanitizePropertyName(name: string): boolean; //# sourceMappingURL=sanitize.d.ts.map