joerghoh commented on code in PR #73:
URL:
https://github.com/apache/sling-org-apache-sling-xss/pull/73#discussion_r4479711419
##########
src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java:
##########
@@ -247,7 +247,7 @@ public String getValidJSToken(String token, String
defaultValue) {
/** http://www.w3.org/TR/css-syntax-3/#hex-digit-diagram */
private static final String HEX_DIGITS = "#[0-9a-f]*";
/** http://www.w3.org/TR/css-syntax-3/#ident-token-diagram */
- private static final String IDENTIFIER = "-?[a-z_" + NON_ASCII +
"][\\w_\\-" + NON_ASCII + "]*";
+ private static final String IDENTIFIER = "(?:--|-?[a-z_" + NON_ASCII +
"])[\\w_\\-" + NON_ASCII + "]*";
Review Comment:
The broader acceptance is intentional: this fixes the shared CSS identifier
grammar, not only `var()` arguments. CSS Syntax permits identifiers beginning
with `--`, including `--` itself
(https://www.w3.org/TR/css-syntax-3/#would-start-an-identifier). That grammar
also applies to standalone identifiers, function arguments, function names, and
dimension units.
Section 4.3.4 explicitly creates a function token from an ident sequence
followed by `(` (https://www.w3.org/TR/css-syntax-3/#consume-ident-like-token).
Thus the change also accepts `--()` and `--foo()`, consistently with token
syntax; it does not establish that these are recognized CSS functions, just as
accepting an arbitrary unit identifier does not establish a supported unit.
Sling still rejects an unclosed `--(` because its complete function pattern
requires the closing parenthesis.
Requiring another character after `--` would conflate the shared token
grammar with the narrower custom-property-name restrictions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
