Skip to content

Commit

Permalink
CSP: Do not highlight directive names with adjacent hyphens (#2662)
Browse files Browse the repository at this point in the history
CSP tokens used `\b` to assert word boundaries but this is incorrect as CSP tokens may contain hyphens (`-`). This replaces the assertions will lookarounds that address the issue.
  • Loading branch information
edukisto authored Nov 30, 2020
1 parent e01ecd0 commit a7ccc16
Show file tree
Hide file tree
Showing 3 changed files with 14 additions and 2 deletions.
3 changes: 2 additions & 1 deletion components/prism-csp.js
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,8 @@

Prism.languages.csp = {
'directive': {
pattern: /\b(?:base-uri|block-all-mixed-content|(?:child|connect|default|font|frame|img|manifest|media|object|script|style|worker)-src|disown-opener|form-action|frame-ancestors|plugin-types|referrer|reflected-xss|report-to|report-uri|require-sri-for|sandbox|upgrade-insecure-requests)\b/i,
pattern: /(^|[^-\da-z])(?:base-uri|block-all-mixed-content|(?:child|connect|default|font|frame|img|manifest|media|object|script|style|worker)-src|disown-opener|form-action|frame-ancestors|plugin-types|referrer|reflected-xss|report-to|report-uri|require-sri-for|sandbox|upgrade-insecure-requests)(?=[^-\da-z]|$)/i,
lookbehind: true,
alias: 'keyword'
},
'safe': {
Expand Down
2 changes: 1 addition & 1 deletion components/prism-csp.min.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 11 additions & 0 deletions tests/languages/csp/issue2661.test
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
default-src-is-a-fake; fake-default-src;

----------------------------------------------------

[
"default-src-is-a-fake; fake-default-src;"
]

----------------------------------------------------

Checks for directive names with adjacent hyphens.

0 comments on commit a7ccc16

Please sign in to comment.