[
https://issues.apache.org/jira/browse/SLING-13401?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh updated SLING-13401:
------------------------------
Priority: Critical (was: Major)
> CSS variable references rejected by getValidStyleToken
> ------------------------------------------------------
>
> Key: SLING-13401
> URL: https://issues.apache.org/jira/browse/SLING-13401
> Project: Sling
> Issue Type: Task
> Affects Versions: XSS Protection API 2.4.12
> Reporter: Joerg Hoh
> Assignee: Joerg Hoh
> Priority: Critical
>
> Upgrading the Sling XSS bundle from 2.4.8 to 2.4.12 causes valid CSS variable
> references such as {{var(--text-white)}} and {{var(--button-light)}} to be
> rejected by {{XSSAPI.getValidStyleToken()}}.
> h3. Behavior in 2.4.8
> These references were accepted, although the identifier regex did not
> explicitly support the double-hyphen prefix used by CSS custom properties.
> The {{NUMBER}} regex could match a standalone hyphen. Within the
> function-argument regex, {{--text-white}} could therefore match as a
> {{NUMBER}} containing {{-}}, followed by an {{IDENTIFIER}} containing
> {{-text-white}}. This unintentionally allowed {{var(--text-white)}} to pass
> validation.
> h3. Behavior in 2.4.12
> SLING-13334 hardened the numeric and function-token regexes against excessive
> backtracking. The revised {{NUMBER}} regex requires at least one digit, so it
> no longer accepts a standalone hyphen.
> However, {{IDENTIFIER}} still permits only one leading hyphen followed by a
> letter or underscore. Consequently, the function-argument regex can no longer
> match {{--text-white}}, and {{var(--text-white)}} is rejected.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
