fix(audit L7): Bild-Variablen lassen ' ( ) ; { } \ nicht mehr zu (kein Ausbruch aus url(...) in der :root-Regel)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/Integrations/Divi/Design/VariableValue.php

@@ -33,7 +33,8 @@ final class VariableValue
 
     private const URL = '/^(?:https?:\/\/[^\s<>"]+|\/(?![\/\\\\])[^\s<>"]*|mailto:[^\s<>"]+|tel:[^\s<>"]+)$/iD';
 
-    private const WEB_URL = '/^https?:\/\/[^\s<>"]+$/iD';
+    /** No ' ( ) ; { } \ either (audit L7): Divi writes an image value unescaped into url(...) inside the :root rule. */
+    private const WEB_URL = '/^https?:\/\/[^\s<>"\'(){};\\\\]+$/iD';
 
     /** @return string|null Null when $value is valid for $type, else a German message. */
     public static function check(string $type, string $value): ?string

tests/Unit/Integrations/Divi/Design/VariableValueTest.php

@@ -70,6 +70,10 @@ final class VariableValueTest extends TestCase
             'images relative path' => ['images', '/wp-content/a.jpg'],
             'images text' => ['images', 'Werkstattbild'],
             'images javascript' => ['images', 'javascript:alert(1)'],
+            // Audit L7: Divi wraps the value as url(...) inside the :root rule, so these end the declaration.
+            'images css injection' => ['images', 'https://x.test/a.png);}body{display:none}a{b:url(x'],
+            'images quote' => ['images', "https://x.test/a'b.png"],
+            'images backslash' => ['images', 'https://x.test/a\\b.png'],
             'fonts empty' => ['fonts', ''],
             'fonts semicolon' => ['fonts', 'Lato; color: red'],
             'fonts quote' => ['fonts', "Lato'"],