CSSMin: Mangle whitespace in embedded SVGs

[lhc/web/wiklou.git] / includes / libs / CSSMin.php

diff --git a/includes/libs/CSSMin.php b/includes/libs/CSSMin.php
index d505562..a9c021e 100644 (file)
--- a/includes/libs/CSSMin.php
+++ b/includes/libs/CSSMin.php
@@ -78,7 +78,12 @@ class CSSMin {
                                $url = $match['file'][0];
 
                                // Skip fully-qualified and protocol-relative URLs and data URIs
-                               if ( substr( $url, 0, 2 ) === '//' || parse_url( $url, PHP_URL_SCHEME ) ) {
+                               // Also skips the rare `behavior` property specifying application's default behavior
+                               if (
+                                       substr( $url, 0, 2 ) === '//' ||
+                                       parse_url( $url, PHP_URL_SCHEME ) ||
+                                       substr( $url, 0, 9 ) === '#default#'
+                               ) {
                                        break;
                                }
 
@@ -137,7 +142,23 @@ class CSSMin {
                if ( preg_match( '/^[\r\n\t\x20-\x7e]+$/', $contents ) ) {
                        // Do not base64-encode non-binary files (sane SVGs).
                        // (This often produces longer URLs, but they compress better, yielding a net smaller size.)
-                       $uri = 'data:' . $type . ',' . rawurlencode( $contents );
+                       $encoded = rawurlencode( $contents );
+                       // Unencode some things that don't need to be encoded, to make the encoding smaller
+                       $encoded = strtr( $encoded, [
+                               '%20' => ' ', // Unencode spaces
+                               '%2F' => '/', // Unencode slashes
+                               '%3A' => ':', // Unencode colons
+                               '%3D' => '=', // Unencode equals signs
+                               '%22' => '"', // Unencode double quotes
+                               '%0A' => ' ', // Change newlines to spaces
+                               '%0D' => ' ', // Change carriage returns to spaces
+                               '%09' => ' ', // Change tabs to spaces
+                       ] );
+                       // Consolidate runs of multiple spaces in a row
+                       $encoded = preg_replace( '/ {2,}/', ' ', $encoded );
+                       // Remove leading and trailing spaces
+                       $encoded = preg_replace( '/^ | $/', '', $encoded );
+                       $uri = 'data:' . $type . ',' . $encoded;
                        if ( !$ie8Compat || strlen( $uri ) < self::DATA_URI_SIZE_LIMIT ) {
                                return $uri;
                        }
@@ -183,17 +204,7 @@ class CSSMin {
                        return self::$mimeTypes[$ext];
                }
 
-               $realpath = realpath( $file );
-               if (
-                       $realpath
-                       && function_exists( 'finfo_file' )
-                       && function_exists( 'finfo_open' )
-                       && defined( 'FILEINFO_MIME_TYPE' )
-               ) {
-                       return finfo_file( finfo_open( FILEINFO_MIME_TYPE ), $realpath );
-               }
-
-               return false;
+               return mime_content_type( realpath( $file ) );
        }
 
        /**
@@ -212,7 +223,7 @@ class CSSMin {
                if ( preg_match( '!^[\w\d:@/~.%+;,?&=-]+$!', $url ) ) {
                        return "url($url)";
                } else {
-                       return 'url("' . strtr( $url, [ '\\' => '\\\\', '"' => '\\"' ] ) . '")';
+                       return "url('" . strtr( $url, [ '\\' => '\\\\', "'" => "\\'" ] ) . "')";
                }
        }
 
@@ -389,6 +400,9 @@ class CSSMin {
                return false;
        }
 
+       /**
+        * @codeCoverageIgnore
+        */
        private static function getUrlRegex() {
                static $urlRegex;
                if ( $urlRegex === null ) {
@@ -474,7 +488,12 @@ class CSSMin {
 
                // Pass thru fully-qualified and protocol-relative URLs and data URIs, as well as local URLs if
                // we can't expand them.
-               if ( self::isRemoteUrl( $url ) || self::isLocalUrl( $url ) ) {
+               // Also skips the rare `behavior` property specifying application's default behavior
+               if (
+                       self::isRemoteUrl( $url ) ||
+                       self::isLocalUrl( $url ) ||
+                       substr( $url, 0, 9 ) === '#default#'
+               ) {
                        return $url;
                }