Skip to content

Fix CSS string token value decoding for backslash-newline and backslash-EOF#224

Closed
Copilot wants to merge 2 commits intotrunkfrom
copilot/fix-css-processor-backslash-newline
Closed

Fix CSS string token value decoding for backslash-newline and backslash-EOF#224
Copilot wants to merge 2 commits intotrunkfrom
copilot/fix-css-processor-backslash-newline

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 7, 2026 •
edited
Loading

CSSProcessor::get_token_value() returns incorrect values for <string-token> when the raw value contains \ + newline or \ + EOF — both of which the CSS Syntax Level 3 spec requires to produce nothing in the decoded value.

// backslash-newline: expected 'string', got 'str\<LF>ing'
$p = CSSProcessor::create( "'str\\\ning'" );
$p->next_token();
$p->get_token_value(); // => 'string'

// backslash-EOF: expected 'string', got 'string\uFFFD'
$p = CSSProcessor::create( "'string\\" );
$p->next_token();
$p->get_token_value(); // => 'string'

Changes

  • decode_string_or_url(): Rewrote the backslash-handling block. Previously the code delegated to is_valid_escape(), which misclassified both cases:

    • \ + newline fell into the "invalid escape" branch, emitting the literal \ and letting the newline pass through as a normal character.
    • \ + EOF-of-CSS was treated as a valid escape, causing decode_escape_at() to be called past the value range and return U+FFFD.

    The new logic consumes the \ first, then: skips if at end of range (EOF case); skips the following newline char(s) for LF/CR/CRLF/FF (backslash-newline case); otherwise decodes as a normal escape.

  • Tests: Added test_string_token_backslash_newline_is_ignored() (covers LF, CR, CRLF, FF, multiple occurrences, leading position) and test_string_token_backslash_eof_is_ignored() (single-quoted, double-quoted, empty string).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/8da41e9a9fe4cc14d23cf7fcef3b80476f54e511
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/aXxr8O /usr/bin/composer install (http block)
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/RdfIZl /usr/bin/composer install --no-interaction --no-progress (http block)
    • Triggering command: /usr/local/bin/php php /usr/bin/composer install --no-interaction --no-progress --optimize-autoloader -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed -e 1s/^X// -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed (http block)
  • https://api.github.com/repos/PHPCSStandards/composer-installer/zipball/e9cf5e4bbf7eeaf9ef5db34938942602838fc2b1
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/aXxr8O /usr/bin/composer install (http block)
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/RdfIZl /usr/bin/composer install --no-interaction --no-progress (http block)
    • Triggering command: /usr/local/bin/php php /usr/bin/composer install --no-interaction --no-progress --optimize-autoloader -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed -e 1s/^X// -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed (http block)
  • https://api.github.com/repos/PHPCompatibility/PHPCompatibility/zipball/9fb324479acf6f39452e0655d2429cc0d3914243
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/aXxr8O /usr/bin/composer install (http block)
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/RdfIZl /usr/bin/composer install --no-interaction --no-progress (http block)
    • Triggering command: /usr/local/bin/php php /usr/bin/composer install --no-interaction --no-progress --optimize-autoloader -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed -e 1s/^X// -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed (http block)
  • https://api.github.com/repos/doctrine/instantiator/zipball/0daa7cfba7b009aa3c95ae585322fb596a4ca2ae
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/aXxr8O /usr/bin/composer install (http block)
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/RdfIZl /usr/bin/composer install --no-interaction --no-progress (http block)
    • Triggering command: /usr/local/bin/php php /usr/bin/composer install --no-interaction --no-progress --optimize-autoloader -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed -e 1s/^X// -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed (http block)
  • https://api.github.com/repos/myclabs/DeepCopy/zipball/07d290f0c47959fd5eed98c95ee5602db07e0b6a
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/aXxr8O /usr/bin/composer install (http block)
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/RdfIZl /usr/bin/composer install --no-interaction --no-progress (http block)
    • Triggering command: /usr/local/bin/php php /usr/bin/composer install --no-interaction --no-progress --optimize-autoloader -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed -e 1s/^X// -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed (http block)
  • https://api.github.com/repos/phar-io/manifest/zipball/65f90285728eae4eae313b8b6ba11b2f5436038e
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/aXxr8O /usr/bin/composer install (http block)
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/RdfIZl /usr/bin/composer install --no-interaction --no-progress (http block)
    • Triggering command: /usr/local/bin/php php /usr/bin/composer install --no-interaction --no-progress --optimize-autoloader -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed -e 1s/^X// -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed (http block)
  • https://api.github.com/repos/phar-io/version/zipball/4f7fd7836c6f332bb2933569e566a0d6c4cbed74
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/aXxr8O /usr/bin/composer install (http block)
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/RdfIZl /usr/bin/composer install --no-interaction --no-progress (http block)
    • Triggering command: /usr/local/bin/php php /usr/bin/composer install --no-interaction --no-progress --optimize-autoloader -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed -e 1s/^X// -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed (http block)
  • https://api.github.com/repos/phpstan/phpstan/zipball/fcf8b71aeab4e1a1131d1783cef97b23a51b87a9
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/aXxr8O /usr/bin/composer install (http block)
    • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/RdfIZl /usr/bin/composer install --no-interaction --no-progress (http block)
    • Triggering command: /usr/local/bin/php php /usr/bin/composer install --no-interaction --no-progress --optimize-autoloader -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed -e 1s/^X// -e ]\)/\\\1/g 1s/^X// -e ]\)/\\\1/g /usr/bin/sed (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI linked an issue Apr 7, 2026 that may be closed by this pull request
CSS Processor string token values mishandle backslash-newline #222
Open
@sirreal
Fix CSS string backslash-newline and backslash-EOF token value decoding
7c568b0 
In decode_string_or_url(), backslash handling now:
- Skips the backslash and following newline (LF/CR/CRLF/FF) without
  adding anything to the decoded value — fixing issue #222
- Skips a trailing backslash at the end of the value range without
  adding anything — fixing issue #223

Also adds targeted tests for both cases.

Agent-Logs-Url: https://github.com/WordPress/php-toolkit/sessions/d5227594-61c0-4efc-bdfa-377a78071205

Co-authored-by: sirreal <841763+sirreal@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix CSS Processor string token values mishandle backslash-newline Fix CSS string token value decoding for backslash-newline and backslash-EOF Apr 7, 2026
Copilot AI requested a review from sirreal April 7, 2026 20:05
@sirreal
Copy link
Copy Markdown
Member

sirreal commented Apr 8, 2026

I'm not happy with this approach, I'll work on this locally.

@sirreal sirreal closed this Apr 8, 2026
@sirreal sirreal deleted the copilot/fix-css-processor-backslash-newline branch April 8, 2026 08:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sirreal sirreal Awaiting requested review from sirreal

Assignees

@sirreal sirreal

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CSS Processor string token values mishandle backslash-newline

2 participants

@sirreal