fix(audit L7): Bild-Variablen lassen ' ( ) ; { } \ nicht mehr zu (kein Ausbruch aus url(...) in der :root-Regel)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-19 23:53:14 +02:00
parent 1b3ef552e7
commit 06b798ab37
2 changed files with 6 additions and 1 deletions
@@ -70,6 +70,10 @@ final class VariableValueTest extends TestCase
            'images relative path' => ['images', '/wp-content/a.jpg'],
            'images text' => ['images', 'Werkstattbild'],
            'images javascript' => ['images', 'javascript:alert(1)'],
+            // Audit L7: Divi wraps the value as url(...) inside the :root rule, so these end the declaration.
+            'images css injection' => ['images', 'https://x.test/a.png);}body{display:none}a{b:url(x'],
+            'images quote' => ['images', "https://x.test/a'b.png"],
+            'images backslash' => ['images', 'https://x.test/a\\b.png'],
            'fonts empty' => ['fonts', ''],
            'fonts semicolon' => ['fonts', 'Lato; color: red'],
            'fonts quote' => ['fonts', "Lato'"],