diff --git a/README.md b/README.md index e1dea54..5f219a6 100644 --- a/README.md +++ b/README.md @@ -13,8 +13,10 @@ Package is substrate of [Latte package](https://github.com/nette/latte/) - Escape HTML attributes - Escape HTML comments - Escape JS -- Escape CSS - Escape URL +- Escape CSS +- Escape CSS specifics for few properties: + - `color` value ## Install @@ -34,12 +36,28 @@ Use: echo 'Registered user: ' . \JakubBoucek\Escape\Escape::html($username); ``` +## CSS specifics + +In few cases you cannot use `\JakubBoucek\Escape\Escape::css($cssColor)` to escape +some known format, because standard escaping is broke CSS format. Class `EscapeCss` has prepared +limited set of known propetries with specefics format: + +### `color` property + +Sanitize value od CSS `color` property to safe format, example: + +```php +echo ''; +``` + +It's prevent attact by escaping color value context. + ## FAQ ### Is it support for escaping SQL query? -No, SQL requires access to active SQL connection to right escape. This package is only aloow to escape contexts without -external requrements. +No, SQL requires access to active SQL connection to right escape. This package is only allows to escape contexts without +external requirements. ## Contributing Please don't hesitate send Issue or Pull Request. diff --git a/src/EscapeCss.php b/src/EscapeCss.php new file mode 100644 index 0000000..2dfc87a --- /dev/null +++ b/src/EscapeCss.php @@ -0,0 +1,56 @@ +` + * + * @see https://developer.mozilla.org/en-US/docs/Web/CSS/color_value#color_keywords + */ + public static function color(string $color): string + { + $valid = (bool)Strings::match( + $color, + '/^\s*(?:[-a-zA-Z]+|#[\da-fA-F]{3,8}|(?:rgba?|hsla?|lch|lab)\([\d,.%\\/ ]+\))\s*$/D' + ); + + if ($valid === false) { + return ''; + } + + return trim($color); + } +} diff --git a/tests/EscapeCssTest.php b/tests/EscapeCssTest.php new file mode 100644 index 0000000..6ffb78a --- /dev/null +++ b/tests/EscapeCssTest.php @@ -0,0 +1,62 @@ +", ''], + ]; + } + + /** + * @dataProvider getCssColorArgs + */ + public function testCssColor(string $data, string $expected): void + { + Assert::same($expected, EscapeCss::color($data)); + } +} + +(new EscapeCssTest())->run();