remove style and script tags

Author: KevinBatdorf

cypress/e2e/block.cy.js

@@ -310,7 +310,7 @@ context('Pattern Css', () => {
 				.invoke('text')
 				.should(
 					'contain',
-					'background-image:url(https://foo.com/bar.jpg?</style><script>alert\\(1\\)</script>)',
+					'background-image:url(https://foo.com/bar.jpg?</style><script>alert\\(1\\)</script>)',
 				);
 		});
 	});

src/components/BlockControl.tsx

@@ -23,6 +23,7 @@ import { focusAtEndOfLine2 } from '../lib/dom';
 import { EditorControls } from './EditorControls';
 import { store as coreStore } from '@wordpress/editor';
 import { addToClassList } from '../lib/classes';
+import { escapeCSS } from '../lib/formatting';
 
 export const BlockControl = (
 	// eslint-disable-next-line
@@ -59,7 +60,7 @@ export const BlockControl = (
 				return;
 			}
 			setWarnings([]);
-			setCss(css);
+			setCss(escapeCSS(css));
 
 			if (!window.patternCss?.transform) return;
 

src/lib/formatting.ts

@@ -0,0 +1,6 @@
+export const escapeCSS = (url: string) =>
+	url
+		.replace(/<\s*script\s*>/gi, '&lt;script&gt;')
+		.replace(/<\s*\/\s*script\s*>/gi, '&lt;/script&gt;')
+		.replace(/<\s*style\s*>/gi, '&lt;style&gt;')
+		.replace(/<\s*\/\s*style\s*>/gi, '&lt;/style&gt;');