This is an automated email from the ASF dual-hosted git repository. joerghoh pushed a commit to branch SLING-13406 in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
commit 73bcb66cc50f3bca6a824be38a3059b8278b8e83 Author: Joerg Hoh <[email protected]> AuthorDate: Thu Oct 29 12:11:56 2026 +0100 SLING-13406: markup with without parenthesis for unqoted urls should be rejected --- src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java | 9 +++++++-- src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java | 9 +++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java b/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java index 8853da5..5aceeb8 100644 --- a/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java +++ b/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java @@ -277,8 +277,13 @@ public class XSSAPIImpl implements XSSAPI { */ private static final String FUNCTION = IDENTIFIER + "\\((?:[\\s,]*+(?:(?:" + NUMBER + ")|(?:" + IDENTIFIER + ")))*+[\\s,]*+\\)"; - /** http://www.w3.org/TR/css-syntax-3/#url-unquoted-diagram */ - private static final String URL_UNQUOTED = "[^\"^'^\\(^\\)^[" + NON_ASCII + "]]*"; + /** + * http://www.w3.org/TR/css-syntax-3/#url-unquoted-diagram + * <p> + * Exclude markup characters here as well: HTML parsing recognizes {@code </style>} even + * inside an unquoted CSS URL. + */ + private static final String URL_UNQUOTED = "[^\"^'^\\(^\\)^<>[" + NON_ASCII + "]]*"; /** http://www.w3.org/TR/css-syntax-3/#url-token-diagram */ private static final String URL = "url\\((?:(?:" + URL_UNQUOTED + ")|(?:" + STRING + "))\\)"; /** composite regular expression for style token validation */ diff --git a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java index 5243725..47e22a5 100644 --- a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java +++ b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java @@ -817,6 +817,15 @@ public class XSSAPIImplTest { {"url('</style><script>alert(1)</script>')", RUBBISH}, {"url('\" onmouseover=\"alert(document.cookie) ')", RUBBISH}, + // Avoid parentheses in the script: otherwise URL_UNQUOTED rejects the payload for an + // unrelated reason. HTML recognizes the closing style tag regardless of CSS quoting + // or tag case. + {"url(</style><script>window.__slingProbe=1</script>)", RUBBISH}, + {"url(</StYlE><script>window.__slingProbe=1</script>)", RUBBISH}, + {"url('</style><script>window.__slingProbe=1</script>')", RUBBISH}, + {"url(\"</style><script>window.__slingProbe=1</script>\")", RUBBISH}, + {"url(</style><script>window.__slingProbe=1</script>)", RUBBISH}, + // invalid tokens {"color: red", RUBBISH} };
