From 2cb3f2d03db8043d5eda718ec1ebe7d69132137a Mon Sep 17 00:00:00 2001
From: Karl Seguin <k@openmymind.io>
Date: Fri, 20 Feb 2026 18:44:54 +0800
Subject: [PATCH] prorper escaping of null character

---
 src/browser/tests/css.html |  8 ++++++++
 src/browser/webapi/CSS.zig | 14 +++++++-------
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/src/browser/tests/css.html b/src/browser/tests/css.html
index ee0db0e0..70fdff47 100644
--- a/src/browser/tests/css.html
+++ b/src/browser/tests/css.html
@@ -69,3 +69,11 @@
     testing.expectEqual(true, CSS.supports('z-index', '10'));
   }
 </script>
+
+<script id="escape_null_character">
+  {
+    testing.expectEqual('\uFFFD', CSS.escape('\x00'));
+    testing.expectEqual('test\uFFFDvalue', CSS.escape('test\x00value'));
+    testing.expectEqual('\uFFFDabc', CSS.escape('\x00abc'));
+  }
+</script>
diff --git a/src/browser/webapi/CSS.zig b/src/browser/webapi/CSS.zig
index 2eed5cf3..56785869 100644
--- a/src/browser/webapi/CSS.zig
+++ b/src/browser/webapi/CSS.zig
@@ -141,16 +141,16 @@ fn hexDigitsNeeded(c: u8) usize {
 }
 
 fn writeEscape(comptime is_first: bool, buf: []u8, c: u8) usize {
+    if (c == 0) {
+        // NULL character becomes replacement character (no backslash)
+        const replacement = "\u{FFFD}";
+        @memcpy(buf[0..replacement.len], replacement);
+        return replacement.len;
+    }
+
     buf[0] = '\\';
     var data = buf[1..];
 
-    if (c == 0) {
-        // NULL character becomes replacement character
-        const replacement = "\u{FFFD}";
-        @memcpy(data[0..replacement.len], replacement);
-        return 1 + replacement.len;
-    }
-
     if (isHexEscape(c) or ((comptime is_first) and c >= '0' and c <= '9')) {
         const hex_str = std.fmt.bufPrint(data, "{x} ", .{c}) catch unreachable;
         return 1 + hex_str.len;