From 0bfe00bbb7548f653acb8fc38960be396c77ff8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Arrufat?= <adria.arrufat@gmail.com>
Date: Tue, 24 Mar 2026 12:53:49 +0900
Subject: [PATCH] css: disallow multiple rules in insertRule

---
 src/browser/tests/css/stylesheet.html    | 18 ++++++++++++++++++
 src/browser/webapi/css/CSSStyleSheet.zig |  2 ++
 2 files changed, 20 insertions(+)

diff --git a/src/browser/tests/css/stylesheet.html b/src/browser/tests/css/stylesheet.html
index af6ba4ef..d014dc45 100644
--- a/src/browser/tests/css/stylesheet.html
+++ b/src/browser/tests/css/stylesheet.html
@@ -480,6 +480,24 @@
 }
 </script>
 
+<script id="CSSStyleSheet_insertRule_multiple_rules">
+{
+    const style = document.createElement('style');
+    document.head.appendChild(style);
+    const sheet = style.sheet;
+
+    let caught = false;
+    try {
+        sheet.insertRule('a { color: red; } b { color: blue; }');
+    } catch (e) {
+        caught = true;
+        testing.expectEqual('SyntaxError', e.name);
+    }
+    testing.expectTrue(caught);
+    testing.expectEqual(0, sheet.cssRules.length);
+}
+</script>
+
 <script id="CSSStyleSheet_replaceSync">
 {
     const sheet = new CSSStyleSheet();
diff --git a/src/browser/webapi/css/CSSStyleSheet.zig b/src/browser/webapi/css/CSSStyleSheet.zig
index dde83529..1d9fdd81 100644
--- a/src/browser/webapi/css/CSSStyleSheet.zig
+++ b/src/browser/webapi/css/CSSStyleSheet.zig
@@ -88,6 +88,8 @@ pub fn insertRule(self: *CSSStyleSheet, rule: []const u8, maybe_index: ?u32, pag
         return error.SyntaxError;
     };
 
+    if (it.next() != null) return error.SyntaxError;
+
     const style_rule = try CSSStyleRule.init(page);
     try style_rule.setSelectorText(parsed_rule.selector, page);