Commit graph

7 commits

Author SHA1 Message Date
Brad Jorsch f7bf5a4e23 Add "wrapper" attribute to <templatestyles/>
The wrapper attribute may contain an extra CSS simple selector to
include when prefixing. For example, including a template as
<templatestyles src="..." wrapper="div.my-template"/> would transform

 .foo .bar { color:red; }

into

 .mw-parser-output div.my-template .foo .bar{color:red}

This can allow particular templates to opt in to the "styles are scoped
to the template itself" model that was desired by some when
TemplateStyles was being designed; the driving use case in the linked
task is doing so for the benefit of side-by-side comparisons of the
current and sandboxed versions of a template.

Bug: T200441
Change-Id: If49d4c5be31feca95abd21452238fd10ab1916b1
2018-10-17 14:17:59 -04:00
Brad Jorsch d1734fbeb2 Add tracking categories for errors
Two tracking categories are added:
* A category to track stylesheets with errors. While it's usually not
  possible to save a stylesheet with errors, it can happen if a
  server-side change makes formerly-valid CSS become invalid.
* A category to track pages displaying errors from incorrect use of
  the <templatestyles/> tag.

Bug: T195676
Change-Id: I123679d4bffe36cb28aca1688c052470027ea2a8
2018-05-29 14:36:03 -04:00
Brad Jorsch b04bd96f58 SECURITY: Reject stylesheets containing "</style"
Premature closing of the style block === HTML injection vector.

Bug: T167812
Change-Id: I34c5f200c689a56d340bce70ffebbf58d27b499e
2017-06-13 11:52:07 -04:00
Brad Jorsch b301a30abf Use wikimedia/css-sanitizer, and rewrite the hooking
wikimedia/css-sanitizer provides a real CSS parser, which should be
safer than poking at things with regular expressions.

Instead of the strange hybrid model that tried to both process inline
CSS and save CSS when the template is saved, it now looks for
<templatestyles src="Title" /> during the parse to do all the
transclusion of styles.

The output method is "<style> tags in the body", pending someone
implementing T160563.

It now also registers a "sanitized-css" content model, which should pick
up the CSS syntax highlighting and will validate the submitted CSS on
submit and prevent a save if it's not valid.

This patch also takes advantage of LGPL-2.x § 3 to relicense the
extension as GPL-2.0+, although at this point none of the LGPL code
remains anyway.

Bug: T133408
Bug: T136054
Bug: T135788
Bug: T135789
Change-Id: I993e6f18d32a43aac8398743133d227b05133bbd
Depends-On: If4eb5bf71f94fa366ec4eddb6964e8f4df6b824a
2017-06-07 15:14:09 +00:00
Coren dfa7e27b5a Linting and slight tweak to parser
- add a tweak to the parser (keep the value tokens in a declaration
  separate in the parsed tree to ease matching at render time
- add error checking to encoding/decoding the templatestyles property
- pick some lint suggested by Brion and Bryan

Change-Id: If60b91e119102c0f0f559fe7e5a4c421c94b7ff4
2016-04-12 15:42:23 +00:00
Raymond b35763edbf Consisteny tweaks: Use lower case chars for message key only
In preparation for adding extension to translatewiki.net

Change-Id: I64fe725ceac7ec1b4d0da9c05e8285cc06278088
2016-04-10 22:49:25 +02:00
Coren 31743445bd TemplateStyles extension prototype
This extension adds a <templatestyles> tag that, when placed
on a template, allows specifying CSS for pages where that
template is transcluded.

Unlike inline styles, the per-template CSS supports rules
with proper selectors, and @media blocks.

THIS VERSION DOES NOT CURRENTLY FILTER DECLARATIONS and is
therefore unsuitable for wikis where unprivileged users should
not be allowed to influcence the pagewide CSS in unrestricted
ways!

Bug: T483
Change-Id: Ibc1cae3079d164f7ac7bcc7c4ded3f02bb048614
2016-04-08 11:08:59 -04:00