Improve detection of template v1-style syntax in CSS/JS contexts

This commit is contained in:
Kijin Sung 2025-03-19 12:44:17 +09:00
parent 04a7734b2e
commit 3e052d2d00
3 changed files with 12 additions and 12 deletions

View file

@ -824,8 +824,10 @@ class TemplateParser_v2
// Exclude {single} curly braces in non-HTML contexts. // Exclude {single} curly braces in non-HTML contexts.
$content = preg_replace_callback('#(<\?php \$this->config->context = \'(?:CSS|JS)\'; \?>)(.*?)(<\?php \$this->config->context = \'HTML\'; \?>)#s', function($match) { $content = preg_replace_callback('#(<\?php \$this->config->context = \'(?:CSS|JS)\'; \?>)(.*?)(<\?php \$this->config->context = \'HTML\'; \?>)#s', function($match) {
$warning = '<?php trigger_error("Template v1 syntax not allowed in CSS/JS context", \E_USER_WARNING); ?>'; $match[2] = preg_replace_callback('#(?<!\{)\{(?!\s)([^{}]+?)\}#', function($m) {
$match[2] = preg_replace('#(?<!\{)\{(?!\s)([^{}]+?)\}#', '&#x1B;&#x7B;' . $warning . '$1&#x1B;&#x7D;', $match[2]); $warning = preg_match('#^\$\w#', $m[1]) ? '<?php trigger_error("Template v1 syntax not allowed in CSS/JS context", \E_USER_WARNING); ?>' : '';
return '&#x1B;&#x7B;' . $warning . $m[1] . '&#x1B;&#x7D;';
}, $match[2]);
return $match[1] . $match[2] . $match[3]; return $match[1] . $match[2] . $match[3];
}, $content); }, $content);

View file

@ -8,17 +8,16 @@ Hello &lt;&quot;world&quot;&gt; (&#039;string&#039;) variable.jpg </span>
</p> </p>
<script type="text/javascript"> <script type="text/javascript">
function() { const str = "Hello \u003C\u0022world\u0022\u003E ('string') variable.jpg";
const tpl = `template literal with ${var} inside`;
const fun = function() {
const foo = 'Hello \u003C\u0022world\u0022\u003E (\u0027string\u0027) variable.jpg'; const foo = 'Hello \u003C\u0022world\u0022\u003E (\u0027string\u0027) variable.jpg';
const bar = 'Hello <"world"> ('string') variable.jpg'; const bar = 'Hello <"world"> ('string') variable.jpg';
const json = "Hello \u003C\u0022world\u0022\u003E ('string') variable.jpg";
} }
</script> </script>
<style> <style>
body { body{background-image: url('Hello &lt;&quot;world&quot;&gt; (&#039;string&#039;) variable.jpg')}
background-image: url('Hello &lt;&quot;world&quot;&gt; (&#039;string&#039;) variable.jpg');
}
</style> </style>
<ul class="test"> <ul class="test">

View file

@ -11,17 +11,16 @@
</p> </p>
<script type="text/javascript"> <script type="text/javascript">
function() { const str = @json($var);
const tpl = `template literal with ${var} inside`;
const fun = function() {
const foo = '{{ $var }}'; const foo = '{{ $var }}';
const bar = '{{ $var|noescape }}'; const bar = '{{ $var|noescape }}';
const json = @json($var);
} }
</script> </script>
<style> <style>
body { body{background-image: url('{{ $var }}')}
background-image: url('{{ $var }}');
}
</style> </style>
<ul class="test"> <ul class="test">