This is an automated email from the ASF dual-hosted git repository. joerghoh pushed a commit to branch SLING-13401 in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
commit 87b92db320a9deab56256cddc8cf80e0ecfb70e0 Author: Joerg Hoh <[email protected]> AuthorDate: Tue Oct 27 15:12:42 2026 +0100 SLING-13401 fix support for CSS variable references in getValidStyleToken --- .../java/org/apache/sling/xss/impl/XSSAPIImpl.java | 2 +- .../org/apache/sling/xss/impl/XSSAPIImplTest.java | 26 ++++++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java b/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java index 8853da5..f91070d 100644 --- a/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java +++ b/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java @@ -247,7 +247,7 @@ public class XSSAPIImpl implements XSSAPI { /** http://www.w3.org/TR/css-syntax-3/#hex-digit-diagram */ private static final String HEX_DIGITS = "#[0-9a-f]*"; /** http://www.w3.org/TR/css-syntax-3/#ident-token-diagram */ - private static final String IDENTIFIER = "-?[a-z_" + NON_ASCII + "][\\w_\\-" + NON_ASCII + "]*"; + private static final String IDENTIFIER = "(?:--|-?[a-z_" + NON_ASCII + "])[\\w_\\-" + NON_ASCII + "]*"; /** * http://www.w3.org/TR/css-syntax-3/#string-token-diagram * <p> diff --git a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java index 5243725..363190c 100644 --- a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java +++ b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java @@ -249,6 +249,8 @@ public class XSSAPIImplTest { "z(" + "1".repeat(50) + "." + "1".repeat(50) + "e", // identifier filler: stresses the NUMBER/IDENTIFIER alternation inside FUNCTION's loop "z(" + "a".repeat(100), + // custom-property identifier without a closing parenthesis + "var(--" + "a".repeat(100), // whitespace/comma filler: stresses the outer [\s,]*+ possessive class "z(" + " ,".repeat(100) }; @@ -746,6 +748,18 @@ public class XSSAPIImplTest { // usual CSS stuff {"background-color", "background-color"}, {"-moz-box-sizing", "-moz-box-sizing"}, + {"--theme-color", "--theme-color"}, + {"--", "--"}, + {"--1", "--1"}, + {"---theme", "---theme"}, + {"auto", "auto"}, + {"_theme", "_theme"}, + {"-webkit-box", "-webkit-box"}, + {"12px", "12px"}, + {"-12px", "-12px"}, + {".5em", ".5em"}, + {"50%", "50%"}, + {"1foo", "1foo"}, {".42%", ".42%"}, {"#fff", "#fff"}, {"right", "right"}, @@ -788,6 +802,10 @@ public class XSSAPIImplTest { {"rgb(255, 255, 255)", "rgb(255, 255, 255)"}, {"translate(10px, 20px)", "translate(10px, 20px)"}, {"rgba(0,0,0,.5)", "rgba(0,0,0,.5)"}, + {"var(--theme-color)", "var(--theme-color)"}, + {"var(--1)", "var(--1)"}, + {"var(--theme-color, blue)", "var(--theme-color, blue)"}, + {"var( --theme-color , red )", "var( --theme-color , red )"}, // NUMBER/IDENTIFIER handoff boundaries that any rewrite must still accept: an // exponent marker with no following digits falls back to being consumed as part of the @@ -803,10 +821,18 @@ public class XSSAPIImplTest { {"+", RUBBISH}, {"-", RUBBISH}, {".", RUBBISH}, + {"-.", RUBBISH}, + {"+.", RUBBISH}, + {"f(-)", RUBBISH}, + {"f(+)", RUBBISH}, + {"f(.)", RUBBISH}, // invalid parenthesis {"rgb(255, 255, 255", RUBBISH}, {"255, 255, 255)", RUBBISH}, + {"var(--theme-color", RUBBISH}, + {"var(--theme-color);color:red", RUBBISH}, + {"var(--theme-color)</style><script>alert(1)</script>", RUBBISH}, // valid tokens {"url(http://example.com/test.png)", "url(http://example.com/test.png)"},
