parseDeclarationList(); $errors = $cssParser->getParseErrors(); if ( $errors ) { // For style attributes with syntax errors, as a fallback // we see if MW's wikitext sanitizer would alter the // style attribute in any way. If no, then we assume it // is safe. There are enough files with errors in style // attributes that don't use any risky features like // css comments or url(), that this is worth it. $alteredStyle = Sanitizer::checkCss( $value ); if ( $alteredStyle === $value ) { // No sketchy CSS features used, its ok despite errors return true; } return [ $errors[0][0], $errors[0][1], $errors[0][2] ]; } $res = $this->validateTokens( $decList->toTokenArray() ); if ( $res !== true ) { return $res; } return true; } /** * entrypoint to check presentational attributes like fill * * Presentational attributes can contain CSS like values such as url() * * @param string $value * @return array|bool True if good or array containing error details */ public function checkPresentationalAttribute( $value ) { if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ) { return [ 'invalid-control-character', 0, 0 ]; } $cssParser = CSSParser::newFromString( $value ); $cvList = $cssParser->parseComponentValueList(); $errors = $cssParser->getParseErrors(); if ( $errors ) { return [ $errors[0][0], $errors[0][1], $errors[0][2] ]; } $res = $this->validateTokens( $cvList->toTokenArray() ); if ( $res !== true ) { return $res; } return true; } /** * Entrypoint to check