Source code

Revision control

Copy as Markdown

Other Tools

[attr-security.html]
['--x: image-set(attr(data-foo))' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['--x: src(attr(data-foo))' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['background-image: src("https://does-not-exist.test/404.png")' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['--x: src(string("https://does-not-exist.test" attr(data-foo)))' with data-foo="/404.png"]
expected: FAIL
['background-image: src(string("https://does-not-exist.test/""404.png"))' with data-foo="/404.png"]
expected: FAIL
['--x: attr(data-foo type(<url>))' with data-foo="url(https://does-not-exist.test/404.png)"]
expected: FAIL
['--x: image(attr(data-foo))' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['background-image: image("https://does-not-exist.test/404.png")' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['background-image: url(https://does-not-exist.test/404.png), attr(data-foo type(<image>))' with data-foo="linear-gradient(#000000, #ffffff)"]
expected: FAIL
['--x: image-set(var(--y, attr(data-foo)))' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['--x: image-set(var(--some-string))' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['background-image: image-set(var(--some-string))' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['--x: image-set(var(--some-string-list))' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['background-image: image-set(var(--some-string-list))' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['--registered-color: attr(data-foo type(<color>))' with data-foo="blue"]
expected: FAIL
['--x: image-set(var(--some-other-url))' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['--x: image-set(if(style(--true): attr(data-foo);))' with data-foo="https://does-not-exist.test/404.png"]
expected: FAIL
['background-image: image-set(\n if(style(--true): url(https://does-not-exist-2.test/404.png);\n else: attr(data-foo);))' with data-foo="https://does-not-exist-2.test/404.png"]
expected: FAIL
['background-image: image-set(if(style(--true): url(https://does-not-exist.test/404.png);\n style(--condition-val): url(https://does-not-exist.test/404.png);\n else: url(https://does-not-exist.test/404.png);))' with data-foo="attr(data-foo type(*))"]
expected: FAIL
['--x: image-set(if(style(--condition-val: if(style(--true): attr(data-foo type(*));)): url(https://does-not-exist.test/404.png);))' with data-foo="3"]
expected: FAIL
['--x: image-set(if(style(--condition-val >= attr(data-foo type(*))): url(https://does-not-exist.test/404.png);))' with data-foo="3"]
expected: FAIL