CSS sanitizer refuses TemplateStyles variable assignment to border-color but does permit background-color
Open, Needs TriagePublicFeature
Actions

Assigned To

None

Authored By

	PerfektesChaos
	May 12 2024, 1:50 AM

Description

Steps to replicate the issue

Edit de:Template:MediaWiki-Button/styles.css
Try to assign any var() to border-color (see lines 105, 115).
Especially border-color: var(--border-color-progressive--hover,#447ff5);

What happens?:

Sanitizer refuses publishing, complaining about such lines.
Sanitizer will accept assignment to various other properties.
Sanitizer does accept background-color: var(--border-color-progressive,#3366cc);
Sanitizer does accept color: var(--color-progressive--hover,#447ff5);

What should have happened instead?:

Sanitizer should accept border-color: var();
There is no higher risk of border-color rather than background-color

Related Objects

Mentioned Here: T368637: Allow use of CSS `var()` for CSS `border` in css-sanitizer
T361934: Support CSS variable fallbacks in template styles

Event Timeline

PerfektesChaos created this task.May 12 2024, 1:50 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 12 2024, 1:50 AM

For now this is intended behavior, see T361934#9692764

You can work around by setting border-top-color, border-bottom-color, etc independently.

Jack_who_built_the_house subscribed.Jul 4 2024, 4:44 AM

border: 1px solid var( --border-color-base, #a2a9b1 ); also works as advised in T368637#9942128.

I don't get why the security issue of variable concatenation made it impossible to also set border-color: var(--border-color-base) without any additional concatenation. This, to me, seems like an easy thing to allow right now without having the perfect to be an enemy of the good.

Sjoerddebruin awarded a token.Jul 25 2024, 9:01 PM

Sjoerddebruin subscribed.

In T364685#9952638, @Jack_who_built_the_house wrote:

border: 1px solid var( --border-color-base, #a2a9b1 ); also works as advised in T368637#9942128.

If the components are split in various declaractions, e.g. a common 1px and other like padding as common ancestor, later various particular colours, e.g background + border + foreground appearance, there is no shorthand border: available.

Izno changed the subtype of this task from "Bug Report" to "Feature Request".Mon, Oct 28, 3:07 AM

Izno moved this task from Backlog to External (css-sanitizer) on the TemplateStyles board.

Izno moved this task from Unsorted to W3C Candidate Rec (or later) on the css-sanitizer board.Mon, Oct 28, 3:15 AM

zdev subscribed.Fri, Nov 8, 3:38 AM

In T364685#9795044, @hgzh wrote:

For now this is intended behavior, see T361934#9692764

Could someone explain why the sanitizer e.g. cannot accept a border-color rule with only a single var(...) as its value?

CSS sanitizer refuses TemplateStyles variable assignment to border-color but does permit background-colorOpen, Needs TriagePublicFeatureActions

Description

Related Objects

Event Timeline

CSS sanitizer refuses TemplateStyles variable assignment to border-color but does permit background-color
Open, Needs TriagePublicFeature
Actions