Improve detection of template v1-style syntax in CSS/JS contexts

This commit is contained in:
Kijin Sung 2025-03-19 12:44:17 +09:00
parent 04a7734b2e
commit 3e052d2d00
3 changed files with 12 additions and 12 deletions

View file

@ -824,8 +824,10 @@ class TemplateParser_v2
// Exclude {single} curly braces in non-HTML contexts.
$content = preg_replace_callback('#(<\?php \$this->config->context = \'(?:CSS|JS)\'; \?>)(.*?)(<\?php \$this->config->context = \'HTML\'; \?>)#s', function($match) {
$warning = '<?php trigger_error("Template v1 syntax not allowed in CSS/JS context", \E_USER_WARNING); ?>';
$match[2] = preg_replace('#(?<!\{)\{(?!\s)([^{}]+?)\}#', '&#x1B;&#x7B;' . $warning . '$1&#x1B;&#x7D;', $match[2]);
$match[2] = preg_replace_callback('#(?<!\{)\{(?!\s)([^{}]+?)\}#', function($m) {
$warning = preg_match('#^\$\w#', $m[1]) ? '<?php trigger_error("Template v1 syntax not allowed in CSS/JS context", \E_USER_WARNING); ?>' : '';
return '&#x1B;&#x7B;' . $warning . $m[1] . '&#x1B;&#x7D;';
}, $match[2]);
return $match[1] . $match[2] . $match[3];
}, $content);

View file

@ -8,17 +8,16 @@ Hello &lt;&quot;world&quot;&gt; (&#039;string&#039;) variable.jpg </span>
</p>
<script type="text/javascript">
function() {
const str = "Hello \u003C\u0022world\u0022\u003E ('string') variable.jpg";
const tpl = `template literal with ${var} inside`;
const fun = function() {
const foo = 'Hello \u003C\u0022world\u0022\u003E (\u0027string\u0027) variable.jpg';
const bar = 'Hello <"world"> ('string') variable.jpg';
const json = "Hello \u003C\u0022world\u0022\u003E ('string') variable.jpg";
}
</script>
<style>
body {
background-image: url('Hello &lt;&quot;world&quot;&gt; (&#039;string&#039;) variable.jpg');
}
body{background-image: url('Hello &lt;&quot;world&quot;&gt; (&#039;string&#039;) variable.jpg')}
</style>
<ul class="test">

View file

@ -11,17 +11,16 @@
</p>
<script type="text/javascript">
function() {
const str = @json($var);
const tpl = `template literal with ${var} inside`;
const fun = function() {
const foo = '{{ $var }}';
const bar = '{{ $var|noescape }}';
const json = @json($var);
}
</script>
<style>
body {
background-image: url('{{ $var }}');
}
body{background-image: url('{{ $var }}')}
</style>
<ul class="test">