Support imports of remote resources #28
Conversation
|
LGTM, but would recommend to have a runtime option for this. |
|
This PR should be merged as it saves the day |
|
Note that Magento suggest using protocol-relative URLs: https://devdocs.magento.com/guides/v2.4/frontend-dev-guide/css-topics/css-preprocess.html So |
|
FYI, this also fails with the new Fonts API: https://developers.google.com/fonts/docs/css2 @jdforrester Could you please consider this PR? It's breaking for Magento2 also. |
Krinkle
left a comment
Krinkle
left a comment
There was a problem hiding this comment.
This should be behind an option to allow it to be disabled as defense in-depth (despite overall trust domain not mattering for this library given we only support trusted input only). Overall, it is welcome however.
|
@MaxSem can you update change for resolve conflict file |
The regex that was meant to handle this already accounted for a lot of edge cases, such as `/css` endpoints without `.css`, and query parameters like `/css?foo` or `/css;foo`, all to carefully avoid matching things like `foocss.less` or `foo.css.bar.less`. However can still be any number of CSS resources served from URLs that don't match that pattern. Instead of trying to match the path segment, just match the start of the URL, which should take care of any edge cases, given that we don't allow importing remote Less code for compilation anyway. Fixes #27. Closes #28. Closes #68.
5 participants
Fixes #27