CSP: Do not highlight directive names with adjacent hyphens (#2662)

CSP tokens used `\b` to assert word boundaries but this is incorrect as CSP tokens may contain hyphens (`-`). This replaces the assertions will lookarounds that address the issue.
PrismJS · Nov 30, 2020 · a7ccc16 · a7ccc16
1 parent e01ecd0
commit a7ccc16
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 2 deletions.
diff --git a/components/prism-csp.js b/components/prism-csp.js
@@ -11,7 +11,8 @@
 
 Prism.languages.csp = {
 	'directive':  {
-		pattern: /\b(?:base-uri|block-all-mixed-content|(?:child|connect|default|font|frame|img|manifest|media|object|script|style|worker)-src|disown-opener|form-action|frame-ancestors|plugin-types|referrer|reflected-xss|report-to|report-uri|require-sri-for|sandbox|upgrade-insecure-requests)\b/i,
+		pattern: /(^|[^-\da-z])(?:base-uri|block-all-mixed-content|(?:child|connect|default|font|frame|img|manifest|media|object|script|style|worker)-src|disown-opener|form-action|frame-ancestors|plugin-types|referrer|reflected-xss|report-to|report-uri|require-sri-for|sandbox|upgrade-insecure-requests)(?=[^-\da-z]|$)/i,
+		lookbehind: true,
 		alias: 'keyword'
 	},
 	'safe': {

diff --git a/components/prism-csp.min.js b/components/prism-csp.min.js
diff --git a/tests/languages/csp/issue2661.test b/tests/languages/csp/issue2661.test
@@ -0,0 +1,11 @@
+default-src-is-a-fake; fake-default-src;
+
+----------------------------------------------------
+
+[
+	"default-src-is-a-fake; fake-default-src;"
+]
+
+----------------------------------------------------
+
+Checks for directive names with adjacent hyphens.