Joerg Hoh created SLING-13401:
---------------------------------
Summary: CSS variable references rejected by getValidStyleToken
Key: SLING-13401
URL: https://issues.apache.org/jira/browse/SLING-13401
Project: Sling
Issue Type: Task
Affects Versions: XSS Protection API 2.4.12
Reporter: Joerg Hoh
Assignee: Joerg Hoh
Upgrading the Sling XSS bundle from 2.4.8 to 2.4.12 causes valid CSS variable
references such as {{var(--text-white)}} and {{var(--button-light)}} to be
rejected by {{XSSAPI.getValidStyleToken()}}.
h3. Behavior in 2.4.8
These references were accepted, although the identifier regex did not
explicitly support the double-hyphen prefix used by CSS custom properties.
The {{NUMBER}} regex could match a standalone hyphen. Within the
function-argument regex, {{--text-white}} could therefore match as a {{NUMBER}}
containing {{-}}, followed by an {{IDENTIFIER}} containing {{-text-white}}.
This unintentionally allowed {{var(--text-white)}} to pass validation.
h3. Behavior in 2.4.12
SLING-13334 hardened the numeric and function-token regexes against excessive
backtracking. The revised {{NUMBER}} regex requires at least one digit, so it
no longer accepts a standalone hyphen.
However, {{IDENTIFIER}} still permits only one leading hyphen followed by a
letter or underscore. Consequently, the function-argument regex can no longer
match {{--text-white}}, and {{var(--text-white)}} is rejected.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
