Skip to content

Commit

Permalink
Avoid repeating the list of CSS image functions
Browse files Browse the repository at this point in the history
  • Loading branch information
rgrove committed Aug 14, 2024
1 parent a5d93bb commit c168413
Showing 1 changed file with 10 additions and 4 deletions.
14 changes: 10 additions & 4 deletions lib/sanitize/css.rb
Original file line number Diff line number Diff line change
Expand Up @@ -229,6 +229,12 @@ def at_rule!(rule)
rule
end

# Returns `true` if the given CSS function name is an image-related function
# that may contain image URLs that need to be validated.
def image_function?(name)
['image', 'image-set', '-webkit-image-set'].include?(name)
end

# Passes the URL value of an @import rule to a block to ensure
# it's an allowed URL
def import_url_allowed?(rule)
Expand Down Expand Up @@ -272,7 +278,7 @@ def property!(prop)
return nil unless valid_url?(child)
end

if ['image-set', 'image', '-webkit-image-set'].include?(name)
if image_function?(name)
return nil unless valid_image?(child)
end

Expand Down Expand Up @@ -349,11 +355,11 @@ def valid_url?(node)
false
end

# Returns `true` if the given node (which is an `image` or `image-set` function) contains only strings
# using an allowlisted protocol.
# Returns `true` if the given node is an image-related function and contains
# only strings that use an allowlisted protocol.
def valid_image?(node)
return false unless node[:node] == :function
return false unless node.key?(:name) && ['image', 'image-set', '-webkit-image-set'].include?(node[:name].downcase)
return false unless node.key?(:name) && image_function?(node[:name].downcase)
return false unless Array === node[:value]

node[:value].each do |token|
Expand Down

0 comments on commit c168413

Please sign in to comment.