From 3e052d2d0087369f95855006897bb4c4435eab9a Mon Sep 17 00:00:00 2001
From: Kijin Sung <kijin@kijinsung.com>
Date: Wed, 19 Mar 2025 12:44:17 +0900
Subject: [PATCH] Improve detection of template v1-style syntax in CSS/JS
 contexts

---
 common/framework/parsers/template/TemplateParser_v2.php | 6 ++++--
 tests/_data/template/v2contextual.executed.html         | 9 ++++-----
 tests/_data/template/v2contextual.html                  | 9 ++++-----
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/common/framework/parsers/template/TemplateParser_v2.php b/common/framework/parsers/template/TemplateParser_v2.php
index be9d4088c..84b010e5d 100644
--- a/common/framework/parsers/template/TemplateParser_v2.php
+++ b/common/framework/parsers/template/TemplateParser_v2.php
@@ -824,8 +824,10 @@ class TemplateParser_v2
 
 		// Exclude {single} curly braces in non-HTML contexts.
 		$content = preg_replace_callback('#(<\?php \$this->config->context = \'(?:CSS|JS)\'; \?>)(.*?)(<\?php \$this->config->context = \'HTML\'; \?>)#s', function($match) {
-			$warning = '<?php trigger_error("Template v1 syntax not allowed in CSS/JS context", \E_USER_WARNING); ?>';
-			$match[2] = preg_replace('#(?<!\{)\{(?!\s)([^{}]+?)\}#', '&#x1B;&#x7B;' . $warning . '$1&#x1B;&#x7D;', $match[2]);
+			$match[2] = preg_replace_callback('#(?<!\{)\{(?!\s)([^{}]+?)\}#', function($m) {
+				$warning = preg_match('#^\$\w#', $m[1]) ? '<?php trigger_error("Template v1 syntax not allowed in CSS/JS context", \E_USER_WARNING); ?>' : '';
+				return '&#x1B;&#x7B;' . $warning . $m[1] . '&#x1B;&#x7D;';
+			}, $match[2]);
 			return $match[1] . $match[2] . $match[3];
 		}, $content);
 
diff --git a/tests/_data/template/v2contextual.executed.html b/tests/_data/template/v2contextual.executed.html
index 69847da11..f36d54714 100644
--- a/tests/_data/template/v2contextual.executed.html
+++ b/tests/_data/template/v2contextual.executed.html
@@ -8,17 +8,16 @@ Hello &lt;&quot;world&quot;&gt; (&#039;string&#039;) variable.jpg	</span>
 </p>
 
 <script type="text/javascript">
-	function() {
+	const str = "Hello \u003C\u0022world\u0022\u003E ('string') variable.jpg";
+	const tpl = `template literal with ${var} inside`;
+	const fun = function() {
 		const foo = 'Hello \u003C\u0022world\u0022\u003E (\u0027string\u0027) variable.jpg';
 		const bar = 'Hello <"world"> ('string') variable.jpg';
-		const json = "Hello \u003C\u0022world\u0022\u003E ('string') variable.jpg";
 	}
 </script>
 
 <style>
-	body {
-		background-image: url('Hello &lt;&quot;world&quot;&gt; (&#039;string&#039;) variable.jpg');
-	}
+	body{background-image: url('Hello &lt;&quot;world&quot;&gt; (&#039;string&#039;) variable.jpg')}
 </style>
 
 <ul class="test">
diff --git a/tests/_data/template/v2contextual.html b/tests/_data/template/v2contextual.html
index 7ca89745a..e8c690844 100644
--- a/tests/_data/template/v2contextual.html
+++ b/tests/_data/template/v2contextual.html
@@ -11,17 +11,16 @@
 </p>
 
 <script type="text/javascript">
-	function() {
+	const str = @json($var);
+	const tpl = `template literal with ${var} inside`;
+	const fun = function() {
 		const foo = '{{ $var }}';
 		const bar = '{{ $var|noescape }}';
-		const json = @json($var);
 	}
 </script>
 
 <style>
-	body {
-		background-image: url('{{ $var }}');
-	}
+	body{background-image: url('{{ $var }}')}
 </style>
 
 <ul class="test">