Load only .map source maps

ai · ai · commit c64b7488d273 · 2026-04-26T13:44:05.000Z
diff --git a/lib/postcss.d.ts b/lib/postcss.d.ts
@@ -351,6 +351,11 @@ declare namespace postcss {
      * to generate correct source maps.
      */
     to?: string
+
+    /**
+     * Disable source map file protections.
+     */
+    unsafeMap?: boolean
   }
 
   export type Postcss = typeof postcss
diff --git a/lib/previous-map.js b/lib/previous-map.js
@@ -16,6 +16,7 @@ function fromBase64(str) {
 class PreviousMap {
   constructor(css, opts) {
     if (opts.map === false) return
+    if (opts.unsafeMap) this.unsafeMap = true
     this.loadAnnotation(css)
     this.inline = this.startWith(this.annotation, 'data:')
 
@@ -30,7 +31,7 @@ class PreviousMap {
 
   consumer() {
     if (!this.consumerCache) {
-      this.consumerCache = new SourceMapConsumer(this.json ?? this.text)
+      this.consumerCache = new SourceMapConsumer(this.json || this.text)
     }
     return this.consumerCache
   }
@@ -83,7 +84,12 @@ class PreviousMap {
     }
   }
 
-  loadFile(path) {
+  loadFile(path, cssFile, trusted) {
+    if (!trusted && !this.unsafeMap) {
+      if (!/\.map$/i.test(path)) {
+        return undefined
+      }
+    }
     this.root = dirname(path)
     if (existsSync(path)) {
       this.mapFile = path
@@ -100,7 +106,7 @@ class PreviousMap {
       } else if (typeof prev === 'function') {
         let prevPath = prev(file)
         if (prevPath) {
-          let map = this.loadFile(prevPath)
+          let map = this.loadFile(prevPath, file, true)
           if (!map) {
             throw new Error(
               'Unable to load previous source map: ' + prevPath.toString()
@@ -124,11 +130,11 @@ class PreviousMap {
     } else if (this.annotation) {
       let map = this.annotation
       if (file) map = join(dirname(file), map)
-      let unknown = this.loadFile(map)
+      let unknown = this.loadFile(map, file, false)
       if (unknown) {
         try {
           this.json = JSON.parse(unknown.replace(/^\)]}'[^\n]*\n/, ''))
-        } catch (e) {
+        } catch {
           return undefined
         }
       }
