fix: attribute selector with no valid attribute name

src/__tests__/attributes.mjs

@@ -1,4 +1,6 @@
 import { test, nodeVersionAtLeast, nodeVersionBefore } from "./util/helpers.mjs";
+import ava from "./util/runner.mjs";
+import parser from "../../dist/index.js";
 
 test("attribute selector", "[href]", (t, tree) => {
   t.deepEqual(tree.nodes[0].nodes[0].attribute, "href");
@@ -556,3 +558,20 @@ testDeprecation("set Attribute#quoteMark", "[data-foo=bar]", (t, tree) => {
   attr.quoteMark = '"';
   t.deepEqual(attr.toString(), '[data-foo="has space"]');
 });
+
+// A trailing `* $ ^ ~ |` immediately before the closing bracket used to look
+// ahead past the end of the token stream and throw a raw TypeError. None of
+// them is a valid operator without a following `=`, so the token is dropped,
+// which matches how `[href=]` already drops an operator that has no value.
+// Asserted with `ava` rather than `test` because the output is intentionally
+// not a round-trip, and pinning it with `test` would assert the lossy form is
+// correct.
+for (const trailing of ["*", "$", "^", "~", "|"]) {
+  ava(`attribute name followed by a trailing ${trailing}`, (t) => {
+    const tree = parser().astSync(`[href${trailing}]`);
+    const attr = tree.nodes[0].nodes[0];
+    t.deepEqual(attr.attribute, "href");
+    t.deepEqual(attr.operator, undefined);
+    t.deepEqual(tree.toString(), "[href]");
+  });
+}

src/__tests__/exceptions.mjs

@@ -29,6 +29,37 @@
   "Expected a closing parenthesis.",
 );
 
+// An attribute selector whose last token before `]` is one of `* $ ^ ~ |`.
+// The `attribute` token loop looked ahead to `next` without checking it
+// existed, so these threw a raw TypeError. Asserted by message for the same
+// reason as the cases above.
+throws(
+  "namespaced attribute name is an asterisk",
+  "[ns|*]",
+  "Expected an attribute.",
+);
+throws("default namespace with asterisk name", "[|*]", "Expected an attribute.");
+throws("any namespace with asterisk name", "[*|*]", "Expected an attribute.");
+throws(
+  "namespaced attribute ending in a dollar",
+  "[ns|$]",
+  "Expected an attribute.",
+);
+throws(
+  "namespaced attribute ending in a caret",
+  "[ns|^]",
+  "Expected an attribute.",
+);
+
+// A bracket pair that contains no attribute name at all. `toString` used to
+// interpolate the string "undefined" into the output.
+throws("universal selector as an attribute", "[ * ]", "Expected an attribute.");
+throws(
+  "asterisk name with trailing space",
+  "[ns|* ]",
+  "Expected an attribute.",
+);
+
 throws("no opening parenthesis", ")");
 throws("no opening parenthesis (2)", ":global.foo)");
 throws("no opening parenthesis (3)", "h1:not(h2:not(h3)))");
@@ -44,10 +75,10 @@
 throws("bad syntax (2)", "! .body");
 
 throws("missing backslash for semicolon", ".;");
 throws("missing backslash for semicolon (2)", ".\;");
 throws(
   "unexpected / foo",
   "-Option\/root",
   "Unexpected '/'. Escaping special characters with \\ may help.",
 );
 throws(

src/parser.js

@@ -219,7 +219,7 @@ export default class Parser {
           }
           break;
         case tokens.asterisk:
-          if (next[TOKEN.TYPE] === tokens.equals) {
+          if (next && next[TOKEN.TYPE] === tokens.equals) {
             node.operator = content;
             lastAdded = "operator";
           } else if (
@@ -256,22 +256,22 @@ export default class Parser {
           }
         // Falls through
         case tokens.caret:
-          if (next[TOKEN.TYPE] === tokens.equals) {
+          if (next && next[TOKEN.TYPE] === tokens.equals) {
             node.operator = content;
             lastAdded = "operator";
           }
           spaceAfterMeaningfulToken = false;
           break;
         case tokens.combinator:
-          if (content === "~" && next[TOKEN.TYPE] === tokens.equals) {
+          if (content === "~" && next && next[TOKEN.TYPE] === tokens.equals) {
             node.operator = content;
             lastAdded = "operator";
           }
           if (content !== "|") {
             spaceAfterMeaningfulToken = false;
             break;
           }
-          if (next[TOKEN.TYPE] === tokens.equals) {
+          if (next && next[TOKEN.TYPE] === tokens.equals) {
             node.operator = content;
             lastAdded = "operator";
           } else if (!node.namespace && !node.attribute) {
@@ -415,6 +415,14 @@ export default class Parser {
       }
       pos++;
     }
+    if (!node.attribute) {
+      // Every token inside the brackets was consumed without one of them
+      // supplying an attribute name. Stringifying now would interpolate the
+      // string "undefined" into the output, so report it as a parse error
+      // instead. Points at the opening bracket, which is where the author
+      // needs to look.
+      return this.expected("attribute", startingToken[TOKEN.START_POS]);
+    }
     unescapeProp(node, "attribute");
     unescapeProp(node, "namespace");
     this.newNode(new Attribute(node));