Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace explode with preg_split. #670

Merged
merged 2 commits into from
Mar 25, 2017
Merged

Replace explode with preg_split. #670

merged 2 commits into from
Mar 25, 2017

Conversation

trepmal
Copy link
Contributor

@trepmal trepmal commented Mar 25, 2017

In cases where Jetpack's safecss_filter_attr is used in place of core's function (and possibly other scenarios), there may be semi-colons in unexpected places.

For example, background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA...);

In that case, explode will break the style, splitting it in the middle of a value. With preg_split we can specify semi-colons that are not inside parentheses.

@trepmal
Copy link
Contributor Author

trepmal commented Mar 25, 2017

Related: #604, #610

@mjangda
Copy link
Contributor

mjangda commented Mar 25, 2017

Thanks for the PR, @trepmal. I'm working on fixing the (unrelated broken) tests but it would be good to add some tests for this particular fix and an inline comment with details on what the regex is trying to catch.

@trepmal
Copy link
Contributor Author

trepmal commented Mar 25, 2017

Writing a test against core is proving tricky since safecss_filter_attr itself explodes on semi-colon (#), so styles are broken before it gets to the plugin.

At the moment, it's impossible to bypass safecss_filter_attr without hacking core.

However, there are some tickets hoping to fix/modernize/filter safecss_filter_attr which could introduce the same issue in a non-hacking-core way.

https://core.trac.wordpress.org/ticket/24157
https://core.trac.wordpress.org/ticket/37134

In cases where Jetpack's `safecss_filter_attr` is used in place of core's function (and possibly other scenarios), there may be semi-colons in unexpected places.

For example, `background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA...);`

In that case, `explode` will break the style, splitting it in the middle of a value. With `preg_split` we can specify semi-colons that are not inside parentheses.
@mjangda mjangda merged commit aa3c031 into master Mar 25, 2017
@mjangda mjangda deleted the fix/process_style branch March 25, 2017 21:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants