https://codereview.appspot.com/10943044/diff/14001/src/com/google/caja/plugin/CssRewriter.java
File src/com/google/caja/plugin/CssRewriter.java (right):
https://codereview.appspot.com/10943044/diff/14001/src/com/google/caja/plugin/CssRewriter.java#newcode429
src/com/google/caja/plugin/CssRewriter.java:429: if
(!CSS21_COLOR_NAMES.contains(colorName.getCanonicalForm())) {
On 2013/07/12 19:45:59, MikeSamuel wrote:
On 2013/07/11 22:33:36, felix8a wrote:
> Is there a reason to whitelist color names instead of just allowing
any
> identifier?
I'd rather not white-list any identifier, though I don't see any
reason not to
whitelist any in the CSS3 set now that more browsers are supporting
it.
Some properties can contain "/" as a token. "font" comes to mind. I
wouldn't
want that combined with an unrecognized color to masquerade as an
unquoted URL.
Should I get rid of this CSS2/CSS3 distinction here or in a follow-on
URL?
either way is fine with me
https://codereview.appspot.com/10943044/
--
---
You received this message because you are subscribed to the Google Groups "Google Caja Discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
