fix: strip // comments from unknown at-rule preludes

packages/less/lib/less/parser/parser-input.js

@@ -214,7 +214,7 @@ export default () => {
      *   group array (or null). `[...]`/`{...}` do NOT shield a reference — only
      *   `(...)` (a declaration-value group) does.
      */
-    parserInput.$parseUntil = (tok, detectBareVar) => {
+    parserInput.$parseUntil = (tok, detectBareVar, stripLineComments) => {
         let quote = '';
         let returnVal = null;
         let inComment = false;
@@ -278,6 +278,25 @@ export default () => {
                             i++;
                             inComment = true;
                             blockDepth++;
+                        } else if (stripLineComments &&
+                            input.charAt(i + 1) === '/' &&
+                            /\s/.test(input.charAt(i - 1))) {
+                            // A `//` comment, which is not CSS and must not
+                            // reach the output. Only when whitespace precedes
+                            // it: everywhere else the scanner absorbs comments
+                            // while skipping whitespace, which is exactly why
+                            // `http://host` and a protocol-relative
+                            // `url(//host/x.png)` are not comments.
+                            const before = input.slice(lastPos, i);
+                            if (before) {
+                                parseGroups.push(before);
+                            }
+                            let nextNewLine = input.indexOf('\n', i + 2);
+                            if (nextNewLine < 0) {
+                                nextNewLine = length;
+                            }
+                            lastPos = nextNewLine;
+                            i = nextNewLine - 1;
                         }
                         break;
                     case '\'':

packages/less/lib/less/parser/parser.js

@@ -1874,7 +1874,7 @@ const Parser = function Parser(context, imports, fileInfo, currentIndex) {
              *   prelude (non-value position); accept `@{var}` interpolation and warn
              *   on a bare `@var` reference (which resolves today but is deprecated).
              */
-            permissiveValue: function (untilTokens, deprecateVariables) {
+            permissiveValue: function (untilTokens, deprecateVariables, stripLineComments) {
                 const entities = this.entities;
                 let i;
                 let e;
@@ -1942,7 +1942,7 @@ const Parser = function Parser(context, imports, fileInfo, currentIndex) {
                 }
                 parserInput.save();
 
-                value = parserInput.$parseUntil(tok, deprecateVariables);
+                value = parserInput.$parseUntil(tok, deprecateVariables, stripLineComments);
 
                 if (value) {
                     if (typeof value === 'string') {
@@ -2350,7 +2350,7 @@ const Parser = function Parser(context, imports, fileInfo, currentIndex) {
                 return e;
             },
             atruleUnknown: function (value, name, hasBlock) {
-                value = this.permissiveValue(/^[{;]/, true);
+                value = this.permissiveValue(/^[{;]/, true, true);
                 hasBlock = (parserInput.currentChar() === '{');
                 if (!value) {
                     if (!hasBlock && parserInput.currentChar() !== ';') {

packages/test-data/tests-unit/at-rules-unknown-line-comments/at-rules-unknown-line-comments.css

@@ -0,0 +1,31 @@
+@supports selector(
+  :focus-visible ) {
+  a {
+    color: red;
+  }
+}
+@supports (display: grid)  {
+  .grid {
+    display: grid;
+  }
+}
+@supports (background: url(http://example.com/a.png)) {
+  .absolute-url {
+    color: blue;
+  }
+}
+@document url-prefix(http://example.com/) {
+  .doc {
+    color: green;
+  }
+}
+@supports (background: url(//cdn.example.com/x.png)) {
+  .protocol-relative {
+    background: url(//cdn.example.com/x.png);
+  }
+}
+@supports (a: b) /* keep me */ {
+  .block-comment {
+    color: teal;
+  }
+}

packages/test-data/tests-unit/at-rules-unknown-line-comments/at-rules-unknown-line-comments.less

@@ -0,0 +1,45 @@
+// A `//` comment inside an unknown at-rule prelude is scanned as raw text by
+// $parseUntil, so it used to survive into the CSS and swallow the rest of the
+// line with it.
+
+@supports selector(
+  :focus-visible // a line comment
+) {
+  a {
+    color: red;
+  }
+}
+
+@supports (display: grid) // trailing comment
+{
+  .grid {
+    display: grid;
+  }
+}
+
+// A `//` that is not preceded by whitespace is not a comment: it is part of a
+// URL. These must be left alone.
+@supports (background: url(http://example.com/a.png)) {
+  .absolute-url {
+    color: blue;
+  }
+}
+
+@document url-prefix(http://example.com/) {
+  .doc {
+    color: green;
+  }
+}
+
+@supports (background: url(//cdn.example.com/x.png)) {
+  .protocol-relative {
+    background: url(//cdn.example.com/x.png);
+  }
+}
+
+// Block comments are valid CSS and stay.
+@supports (a: b) /* keep me */ {
+  .block-comment {
+    color: teal;
+  }
+}