joerghoh commented on code in PR #73:
URL:
https://github.com/apache/sling-org-apache-sling-xss/pull/73#discussion_r4479711419
##########
src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java:
##########
@@ -247,7 +247,7 @@ public String getValidJSToken(String token, String
defaultValue) {
/** http://www.w3.org/TR/css-syntax-3/#hex-digit-diagram */
private static final String HEX_DIGITS = "#[0-9a-f]*";
/** http://www.w3.org/TR/css-syntax-3/#ident-token-diagram */
- private static final String IDENTIFIER = "-?[a-z_" + NON_ASCII +
"][\\w_\\-" + NON_ASCII + "]*";
+ private static final String IDENTIFIER = "(?:--|-?[a-z_" + NON_ASCII +
"])[\\w_\\-" + NON_ASCII + "]*";
Review Comment:
The two-hyphen branch is intentional: CSS Syntax permits an identifier to
begin with `--`, followed by zero or more identifier characters
(https://www.w3.org/TR/css-syntax-3/#would-start-an-identifier).
`getValidStyleToken()` validates token syntax, rather than custom-property
semantics, so the same identifier grammar applies to function names. The
complete function pattern still requires a closing parenthesis; `--(` is
rejected. Requiring a character after `--` would unnecessarily exclude a valid
identifier token.
##########
src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java:
##########
@@ -746,6 +748,18 @@ static String[][] dataForValidStyleToken() {
// usual CSS stuff
{"background-color", "background-color"},
{"-moz-box-sizing", "-moz-box-sizing"},
+ {"--theme-color", "--theme-color"},
Review Comment:
This case deliberately tests CSS token syntax: `--` is a valid identifier
token, although CSS Variables reserves it and excludes it from custom-property
names (https://www.w3.org/TR/css-variables-1/#defining-variables).
`getValidStyleToken()` is a token validator, not a custom-property-name
validator, so I would keep it in the valid section. A brief explanatory comment
would make that distinction clearer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
