Skip to content

Conversation

@dpvc
Copy link
Member

@dpvc dpvc commented Jul 16, 2024

This PR improves the handling of CSS styles, in particular the use of quotation marks and backslashes in CSS style values, and sanitizes CSS values when output as a string, avoiding a potential for CSS insertion. It also replaces newlines by spaces to avoid some unusual parsing by browsers that newlines can cause.

The parsing of a CSS string now handles quoted material properly, and in the case that a value includes an unmatched quotation mark, one is appended to make sure they are matched. When outputting a CSS value, the value is trimmed at the first unquoted semi-colon to avoid the possibility of having the value insert additional unexpected CSS rules.

I will make some tests for this in a separate PR.

@dpvc dpvc requested a review from zorkow July 16, 2024 00:30
@dpvc dpvc added this to the v4.0 milestone Jul 16, 2024
Copy link
Member

@zorkow zorkow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm.
I did some simple manual tests in node to check the patterns. They appear to work as expected. But some detailed tests will be good.

@dpvc dpvc merged commit 757c77c into develop Jul 16, 2024
@dpvc dpvc deleted the verify-styles branch July 16, 2024 14:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants