(sling-org-apache-sling-xss) branch master updated: SLING-13406: markup without parenthesis for unqoted urls should … (#74)

[joerghoh]

This is an automated email from the ASF dual-hosted git repository.

joerghoh pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git


The following commit(s) were added to refs/heads/master by this push:
     new c893472  SLING-13406: markup without parenthesis for unqoted urls 
should … (#74)
c893472 is described below

commit c89347260f465ae2f49e6f613c1648439f9a84e1
Author: Jörg Hoh <joerg...@users.noreply.github.com>
AuthorDate: Thu Oct 29 19:42:50 2026 +0100

    SLING-13406: markup without parenthesis for unqoted urls should … (#74)
    
    * SLING-13406: markup without parenthesis for unqoted urls should be 
rejected
---
 src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java     | 9 +++++++--
 src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java | 9 +++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java 
b/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
index 8853da5..cb58342 100644
--- a/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
+++ b/src/main/java/org/apache/sling/xss/impl/XSSAPIImpl.java
@@ -277,8 +277,13 @@ public class XSSAPIImpl implements XSSAPI {
      */
     private static final String FUNCTION =
             IDENTIFIER + "\\((?:[\\s,]*+(?:(?:" + NUMBER + ")|(?:" + 
IDENTIFIER + ")))*+[\\s,]*+\\)";
-    /** http://www.w3.org/TR/css-syntax-3/#url-unquoted-diagram */
-    private static final String URL_UNQUOTED = "[^\"^'^\\(^\\)^[" + NON_ASCII 
+ "]]*";
+    /**
+     * http://www.w3.org/TR/css-syntax-3/#url-unquoted-diagram
+     * <p>
+     * Exclude markup characters here as well: HTML parsing recognizes {@code 
</style>} even
+     * inside an unquoted CSS URL.
+     */
+    private static final String URL_UNQUOTED = "[^\"'()<>^" + NON_ASCII + "]*";
     /** http://www.w3.org/TR/css-syntax-3/#url-token-diagram */
     private static final String URL = "url\\((?:(?:" + URL_UNQUOTED + ")|(?:" 
+ STRING + "))\\)";
     /** composite regular expression for style token validation */
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java 
b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
index 5243725..47e22a5 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
@@ -817,6 +817,15 @@ public class XSSAPIImplTest {
             {"url('</style><script>alert(1)</script>')", RUBBISH},
             {"url('\" onmouseover=\"alert(document.cookie) ')", RUBBISH},
 
+            // Avoid parentheses in the script: otherwise URL_UNQUOTED rejects 
the payload for an
+            // unrelated reason. HTML recognizes the closing style tag 
regardless of CSS quoting
+            // or tag case.
+            {"url(</style><script>window.__slingProbe=1</script>)", RUBBISH},
+            {"url(</StYlE><script>window.__slingProbe=1</script>)", RUBBISH},
+            {"url('</style><script>window.__slingProbe=1</script>')", RUBBISH},
+            {"url(\"</style><script>window.__slingProbe=1</script>\")", 
RUBBISH},
+            {"url(</style><script>window.__slingProbe=1</script>)", RUBBISH},
+
             // invalid tokens
             {"color: red", RUBBISH}
         };