"internal:" filter doesn't work with inline CSS

hass - February 23, 2007 - 14:28
Project:Path Filter
Version:6.x-1.x-dev
Component:Code
Category:bug report
Priority:normal
Assigned:Unassigned
Status:closed
Description

<ul style="list-style: none url(internal:themes/mytheme/img/test.gif);">

#1

RayZ - February 23, 2007 - 14:59

Currently, Path Filter intentionally only handles Drupal paths inside double-quotes. This keeps the regex simple and covers the vast majority of uses. So technically this is probably a (quite valid) feature request.

The issue is finding a well-defined way to detect the end of the path. By translating only paths in double-quotes that was simple ... the path ends when you hit the closing double quote. If we remove that restriction, we need to decide which characters mark the end of the path. Some obvious ones would include whitespace, double or single quote, closing paren, bracket or brace. Anything else?

I'm just concerned about having a robust criterion. I don't want it to accidentally grab only part of, or gobble up more than the intended path.

Thoughts?

#2

hass - February 24, 2007 - 10:04

i think url(internal:themes/mytheme/img/test.gif) is very save from CSS point of view. An inline CSS style can only inside a style="" attribute and the content should contain a URL surrounded by url( and ). But you cannot say for sure there will be no spaces inside - for e.g. url ( or url ( internal: and so on is absolutely possible.

#3

hass - February 24, 2007 - 10:14

Additional, if you don't test for a path or path and filename you are unsafe... but there are tons of regexp examples on the net and inside drupal for such tasks. shouldn't be a major problem.

#4

Benjamin Melançon - August 16, 2008 - 11:39

For what it's worth, adding filtering on single quotation marks would seem to be the most sure and least resource intensive solution. That would be legal within inline CSS and avoid needing crazy new regular expression processing.

benjamin, Agaric Design Collective

#5

mrfelton - May 16, 2009 - 18:06
Version:4.7.x-1.x-dev» 6.x-1.x-dev
Status:active» fixed

Both double and single quotes are now handled in the D6 branch, which should fix this issue. Changes will be backported soon.

#6

System Message - May 30, 2009 - 18:10
Status:fixed» closed

Automatically closed -- issue fixed for 2 weeks with no activity.

 
 

Drupal is a registered trademark of Dries Buytaert.