[jira] [Updated] (SLING-4176) Sightly: StyleToken context is doing nothing

["Vlad Bailescu (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SLING-4176?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Vlad Bailescu updated SLING-4176:
---------------------------------
    Attachment: SLING-4176_Sightly_StyleToken_context_is_doing_nothing.patch

> Sightly: StyleToken context is doing nothing
> --------------------------------------------
>
>                 Key: SLING-4176
>                 URL: https://issues.apache.org/jira/browse/SLING-4176
>             Project: Sling
>          Issue Type: Bug
>          Components: Extensions, Scripting
>            Reporter: Vlad Bailescu
>            Assignee: Felix Meschberger
>            Priority: Minor
>              Labels: Sightly
>             Fix For: XSS Protection API 1.0.0, Scripting Sightly Engine 1.0.0
>
>         Attachments: SLING-4176_Sightly_StyleToken_context_is_doing_nothing.patch
>
>
> The context='styleToken' expression option doesn't seem to be doing anything (it seems to work as context='unsafe'). Similarly to scriptToken, this should actually be a validator that only allows following CSS tokens:
> - Identifiers, e.g.: red, or -moz-box-sizing
> - Numbers and dimensions, e.g.: 42, 42deg, .42s or 42%
> - Strings, e.g.: "it's there"
> - Hex colors, e.g.: #fff
> - Functions (making sure to have matching parenthesis!), e.g.: rgba(20%, 20%, 100%, 0.02), or url('data:image/png;base64,iVB...')



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)