Bug: T208881
Change-Id: I9a4ced2bc47eb5f96cf35e693bf5261c48acb126
| image\s*\(
| image-set\s*\(
| attr\s*\([^)]+[\s,]+url
| image\s*\(
| image-set\s*\(
| attr\s*\([^)]+[\s,]+url
!ix', $value ) ) {
return '/* insecure input */';
}
!ix', $value ) ) {
return '/* insecure input */';
}
],
[ '/* insecure input */', 'foo: attr( title, url );' ],
[ '/* insecure input */', 'foo: attr( title url );' ],
],
[ '/* insecure input */', 'foo: attr( title, url );' ],
[ '/* insecure input */', 'foo: attr( title url );' ],
+ [ '/* insecure input */', 'foo: var(--evil-attribute)' ],