Copilot commented on code in PR #73:
URL:
https://github.com/apache/sling-org-apache-sling-xss/pull/73#discussion_r4479626821
##########
src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java:
##########
@@ -247,7 +247,7 @@ public String getValidJSToken(String token, String
defaultValue) {
/** http://www.w3.org/TR/css-syntax-3/#hex-digit-diagram */
private static final String HEX_DIGITS = "#[0-9a-f]*";
/** http://www.w3.org/TR/css-syntax-3/#ident-token-diagram */
- private static final String IDENTIFIER = "-?[a-z_" + NON_ASCII +
"][\\w_\\-" + NON_ASCII + "]*";
+ private static final String IDENTIFIER = "(?:--|-?[a-z_" + NON_ASCII +
"])[\\w_\\-" + NON_ASCII + "]*";
Review Comment:
This change makes `--` a valid standalone identifier (because the trailing
part is `*`, it can be empty). If `IDENTIFIER` is reused for other CSS
constructs (e.g., function names), this also implicitly allows tokens like
`--(` and generally broadens the accepted token surface more than needed.
Consider tightening the custom-property branch to require at least one ident
character after `--` (e.g., `--...+`), or splitting into separate patterns for
custom-property identifiers vs general identifiers so `--`-only doesn’t
validate unintentionally.
##########
src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java:
##########
@@ -746,6 +748,18 @@ static String[][] dataForValidStyleToken() {
// usual CSS stuff
{"background-color", "background-color"},
{"-moz-box-sizing", "-moz-box-sizing"},
+ {"--theme-color", "--theme-color"},
Review Comment:
Including `{\"--\", \"--\"}` as a valid style token is surprising because
`--` is typically an incomplete custom property name in CSS usage (custom
properties are generally `--` followed by at least one character). If the
intent is to align with the CSS tokenizer (where an ident token of `--` may
still exist), add a brief comment explaining why this is expected/desired for
Sling’s sanitizer; otherwise, consider moving this case to the invalid section
to better reflect real-world custom property names.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
