Crass: A large number of adjacent CSS comments can trigger a SystemStackError

Impact

When the :preserve_comments option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError.

Patches

This is fixed in Crass 1.0.7, which no longer recurses when discarding comments.

Workarounds

Set the :preserve_comments option to true if this is acceptable to your use case (recursion doesn't occur when comments are preserved).