CSS handling is hard, and depends on an autogenerated policy file, css-defs.js which is large and opaque to debugging because of auto-generated regular expressions that grow super-linearly as we expand the amount of CSS3 we support.
I think we should change our posture from: 1. Whitelist property names. 2. Recognize and rewrite URIs. 3. Require property values match signatures collected from the CSS2 and CSS3 specs to 1. Whitelist property names as now. 2. Recognize and rewrite URIs as now. 3. Instead of using the "cssExtra" regular expressions, treat values as a sequence of tokens and function calls which are vetted in the same way as property values. For each property value and function (like rgb(...) and rgba(...)), examine the CSS signature to derive the following 1. A set of allowed keywords 2. Whether quoted strings are URLs 3. Whether quoted strings can be an innocuous symbol like a font-family name. 4. Whether non-negative quantities are allowed 5. Whether negative quantities are allowed 6. Functions allowed We ignore vendor prefixes when matching keyword and function names, so -moz-foo is treated as foo for the purposes of whitelisting. Treating functions (like rgba(...)) as top-level schema entities means we can still catch all URLs accurately for rewriting, and pass no unrecognized keywords or functions, but not generate regular expressions. -- --- You received this message because you are subscribed to the Google Groups "Google Caja Discuss" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
