resourceloader: CSSMin::getLocalFileReferences now strips anchors

[lhc/web/wiklou.git] / includes / libs / CSSMin.php

diff --git a/includes/libs/CSSMin.php b/includes/libs/CSSMin.php
index 454fd41..92a4f9e 100644 (file)
--- a/includes/libs/CSSMin.php
+++ b/includes/libs/CSSMin.php
@@ -19,7 +19,7 @@
  * @version 0.1.1 -- 2010-09-11
  * @author Trevor Parscal <tparscal@wikimedia.org>
  * @copyright Copyright 2010 Wikimedia Foundation
- * @license http://www.apache.org/licenses/LICENSE-2.0
+ * @license Apache-2.0
  */
 
 /**
@@ -72,15 +72,24 @@ class CSSMin {
                                $url = $match['file'][0];
 
                                // Skip fully-qualified and protocol-relative URLs and data URIs
-                               // Also skips the rare `behavior` property specifying application's default behavior
                                if (
                                        substr( $url, 0, 2 ) === '//' ||
-                                       parse_url( $url, PHP_URL_SCHEME ) ||
-                                       substr( $url, 0, 9 ) === '#default#'
+                                       parse_url( $url, PHP_URL_SCHEME )
                                ) {
                                        break;
                                }
 
+                               // Strip trailing anchors - T115436
+                               $anchor = strpos( $url, '#' );
+                               if ( $anchor !== false ) {
+                                       $url = substr( $url, 0, $anchor );
+
+                                       // '#some-anchors' is not a file
+                                       if ( $url === '' ) {
+                                               break;
+                                       }
+                               }
+
                                $files[] = $path . $url;
                        }
                }
@@ -179,7 +188,7 @@ class CSSMin {
         * @return string
         */
        public static function serializeStringValue( $value ) {
-               $value = strtr( $value, [ "\0" => "\xEF\xBF\xBD", '\\' => '\\\\', '"' => '\\"' ] );
+               $value = strtr( $value, [ "\0" => "\u{FFFD}", '\\' => '\\\\', '"' => '\\"' ] );
                $value = preg_replace_callback( '/[\x01-\x1f\x7f]/', function ( $match ) {
                        return '\\' . base_convert( ord( $match[0] ), 10, 16 ) . ' ';
                }, $value );
@@ -399,6 +408,7 @@ class CSSMin {
                        // Match these three variants separately to avoid broken urls when
                        // e.g. a double quoted url contains a parenthesis, or when a
                        // single quoted url contains a double quote, etc.
+                       // FIXME: Simplify now we only support PHP 7.0.0+
                        // Note: PCRE doesn't support multiple capture groups with the same name by default.
                        // - PCRE 6.7 introduced the "J" modifier (PCRE_INFO_JCHANGED for PCRE_DUPNAMES).
                        //   https://secure.php.net/manual/en/reference.pcre.pattern.modifiers.php
@@ -484,11 +494,11 @@ class CSSMin {
 
                // Pass thru fully-qualified and protocol-relative URLs and data URIs, as well as local URLs if
                // we can't expand them.
-               // Also skips the rare `behavior` property specifying application's default behavior
+               // Also skips anchors or the rare `behavior` property specifying application's default behavior
                if (
                        self::isRemoteUrl( $url ) ||
                        self::isLocalUrl( $url ) ||
-                       substr( $url, 0, 9 ) === '#default#'
+                       substr( $url, 0, 1 ) === '#'
                ) {
                        return $url;
                }