1.0.12

Security

Inline style=" attributes are now checked with the same CSS rules already applied to <style>` element text (GHSA-jfrr-ch68-f2w9). Reported by @Asadbeknur.

Since 1.0.10, <style> element text has been normalized for CSS escapes and checked for @import, expression() and external or data: url() values. Inline style attributes were only matched against a pattern that required a quote after url(, even though CSS makes those quotes optional. The same payload was therefore rejected inside a <style> block and accepted as an attribute.

Closed in this release:

• url(//host/x) and url(https://host/x) without quotes — the reported vector
• url("data:..."), which slipped through even when quoted
• url (…) with whitespace before the parenthesis, URL(…) in uppercase, and a newline inside url()
• CSS hex-escaped schemes and slashes, such as url(\\68 ttps://host/x) and url(\\2f\\2f host/x)
• @import and expression() in an attribute value

Same-document references like url(#gradient) and ordinary declarations are unaffected, and are covered by new preservation tests.

Anyone embedding untrusted SVG or HTML should update. Grav users should take the next Grav release, which bundles this version.