Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(audit L7): Bild-Variablen lassen ' ( ) ; { } \ nicht mehr zu (kein Ausbruch aus url(...) in der :root-Regel)

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-10-19 23:53:14 +02:00
co-authored by Claude Sonnet 5.5
parent 1b3ef552e7
commit 06b798ab37
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/Divi/Design/VariableValue.php
+2 -1
View File
@@ -33,7 +33,8 @@ final class VariableValue
private const URL = '/^(?:https?:\/\/[^\s<>"]+|\/(?![\/\\\\])[^\s<>"]*|mailto:[^\s<>"]+|tel:[^\s<>"]+)$/iD';
private const WEB_URL = '/^https?:\/\/[^\s<>"]+$/iD';
/** No ' ( ) ; { } \ either (audit L7): Divi writes an image value unescaped into url(...) inside the :root rule. */
private const WEB_URL = '/^https?:\/\/[^\s<>"\'(){};\\\\]+$/iD';
/** @return string|null Null when $value is valid for $type, else a German message. */
public static function check(string $type, string $value): ?string