This is an automated email from the ASF dual-hosted git repository.
joerghoh pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
The following commit(s) were added to refs/heads/master by this push:
new 14203b3 SLING-13401 fix support for CSS variable references (#73)
14203b3 is described below
commit 14203b3c3d6dbf78e2e58ef31cec2453d72d2464
Author: Jörg Hoh <[email protected]>
AuthorDate: Thu Nov 5 12:32:09 2026 +0100
SLING-13401 fix support for CSS variable references (#73)
* SLING-13401 fix support for CSS variable references in getValidStyleToken
---
.../java/org/apache/sling/xss/impl/XSSAPIImpl.java | 2 +-
.../org/apache/sling/xss/impl/XSSAPIImplTest.java | 27 ++++++++++++++++++++++
2 files changed, 28 insertions(+), 1 deletion(-)
diff --git a/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
b/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
index cb58342..3cd60cc 100644
--- a/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
+++ b/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
@@ -247,7 +247,7 @@ public class XSSAPIImpl implements XSSAPI {
/** http://www.w3.org/TR/css-syntax-3/#hex-digit-diagram */
private static final String HEX_DIGITS = "#[0-9a-f]*";
/** http://www.w3.org/TR/css-syntax-3/#ident-token-diagram */
- private static final String IDENTIFIER = "-?[a-z_" + NON_ASCII +
"][\\w_\\-" + NON_ASCII + "]*";
+ private static final String IDENTIFIER = "(?:--|-?[a-z_" + NON_ASCII +
"])[\\w_\\-" + NON_ASCII + "]*";
/**
* http://www.w3.org/TR/css-syntax-3/#string-token-diagram
* <p>
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
index 47e22a5..f77562d 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
@@ -249,6 +249,8 @@ public class XSSAPIImplTest {
"z(" + "1".repeat(50) + "." + "1".repeat(50) + "e",
// identifier filler: stresses the NUMBER/IDENTIFIER alternation
inside FUNCTION's loop
"z(" + "a".repeat(100),
+ // custom-property identifier without a closing parenthesis
+ "var(--" + "a".repeat(100),
// whitespace/comma filler: stresses the outer [\s,]*+ possessive
class
"z(" + " ,".repeat(100)
};
@@ -746,6 +748,19 @@ public class XSSAPIImplTest {
// usual CSS stuff
{"background-color", "background-color"},
{"-moz-box-sizing", "-moz-box-sizing"},
+ {"--theme-color", "--theme-color"},
+ // "--" is a valid CSS identifier token, but reserved as a
custom-property name.
+ {"--", "--"},
+ {"--1", "--1"},
+ {"---theme", "---theme"},
+ {"auto", "auto"},
+ {"_theme", "_theme"},
+ {"-webkit-box", "-webkit-box"},
+ {"12px", "12px"},
+ {"-12px", "-12px"},
+ {".5em", ".5em"},
+ {"50%", "50%"},
+ {"1foo", "1foo"},
{".42%", ".42%"},
{"#fff", "#fff"},
{"right", "right"},
@@ -788,6 +803,10 @@ public class XSSAPIImplTest {
{"rgb(255, 255, 255)", "rgb(255, 255, 255)"},
{"translate(10px, 20px)", "translate(10px, 20px)"},
{"rgba(0,0,0,.5)", "rgba(0,0,0,.5)"},
+ {"var(--theme-color)", "var(--theme-color)"},
+ {"var(--1)", "var(--1)"},
+ {"var(--theme-color, blue)", "var(--theme-color, blue)"},
+ {"var( --theme-color , red )", "var( --theme-color , red )"},
// NUMBER/IDENTIFIER handoff boundaries that any rewrite must
still accept: an
// exponent marker with no following digits falls back to being
consumed as part of the
@@ -803,10 +822,18 @@ public class XSSAPIImplTest {
{"+", RUBBISH},
{"-", RUBBISH},
{".", RUBBISH},
+ {"-.", RUBBISH},
+ {"+.", RUBBISH},
+ {"f(-)", RUBBISH},
+ {"f(+)", RUBBISH},
+ {"f(.)", RUBBISH},
// invalid parenthesis
{"rgb(255, 255, 255", RUBBISH},
{"255, 255, 255)", RUBBISH},
+ {"var(--theme-color", RUBBISH},
+ {"var(--theme-color);color:red", RUBBISH},
+ {"var(--theme-color)</style><script>alert(1)</script>", RUBBISH},
// valid tokens
{"url(http://example.com/test.png)",
"url(http://example.com/test.png)"},
