PR-4.4-dev Pending

User tests: Successful: Unsuccessful:

avatar SniperSister
SniperSister
7 Aug 2023

Summary of Changes

This PR allows @ characters to be used in CSS identifiers.

Yes, I'm aware that potentially more characters would be allowed, however this specific character is used in the widely popular CSS framework UIkit (https://getuikit.com/docs/visibility#responsive) and therefore has potentially broad usage in the community.

Testing Instructions

Try to add "hidden@l" as a module class.

Actual result BEFORE applying this Pull Request

Warning.

Expected result AFTER applying this Pull Request

Class being saved.

avatar joomla-cms-bot joomla-cms-bot - change - 7 Aug 2023
Category Libraries
avatar SniperSister SniperSister - open - 7 Aug 2023
avatar SniperSister SniperSister - change - 7 Aug 2023
Status New Pending
avatar SniperSister SniperSister - change - 7 Aug 2023
Labels Added: PR-4.3-dev
avatar brianteeman
brianteeman - comment - 7 Aug 2023

to the best of my knowledge the use special characters like !, @, #, $, %, is not allowed in css class names

avatar brianteeman
brianteeman - comment - 7 Aug 2023

https://www.w3.org/TR/CSS2/syndata.html#:~:text=In%20CSS%2C%20identifiers%20(including%20element,hyphen%20followed%20by%20a%20digit.

In CSS, identifiers (including element names, classes, and IDs in selectors) can contain only the characters [a-zA-Z0-9] and ISO 10646 characters U+00A0 and higher, plus the hyphen (-) and the underscore (_); they cannot start with a digit, two hyphens, or a hyphen followed by a digit.

This therefore excludes the @ U+0040

avatar SniperSister
SniperSister - comment - 7 Aug 2023

That's true for CSS 2 selectors, however if I read the CSS 3 grammer defintion correctly, CSS3 includes a wider range of unicode characters including the @

https://www.w3.org/TR/selectors-3/#grammar

avatar brianteeman
brianteeman - comment - 7 Aug 2023

That grammar is very hard to read. I relied on the w3c css tester and it says no

image

avatar SniperSister
SniperSister - comment - 7 Aug 2023

In the CSS file you'll have to escape the @ sign using a backslash:

.uk-hidden\@m {color:blue}

avatar viocassel viocassel - test_item - 7 Aug 2023 - Tested successfully
avatar viocassel
viocassel - comment - 7 Aug 2023

I have tested this item successfully on 4c51aef


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/41332.

avatar brianteeman
brianteeman - comment - 7 Aug 2023

I guess these need updating as well

/**
* The following regex rules are based on the Html::cleanCssIdentifier method from Drupal
* https://github.com/drupal/drupal/blob/8.8.5/core/lib/Drupal/Component/Utility/Html.php#L116-L130
*
* with the addition for Joomla that we allow the colon (U+003A).
*/

/**
* The following regex rules are based on the Html::cleanCssIdentifier method from Drupal
* https://github.com/drupal/drupal/blob/8.8.5/core/lib/Drupal/Component/Utility/Html.php#L116-L130
*
* with the addition for Joomla that we allow the colon (U+003A).
*/

avatar brianteeman
brianteeman - comment - 7 Aug 2023

This will only work as you expect if all fields that ask for a class have validate="CssIdentifier"

scrub that - I guess if they dont have that validation rule at all then this PR makes no difference to that field

avatar brianteeman
brianteeman - comment - 7 Aug 2023

My 2c is that this is a bad idea. Allowing a user to add a class in html that they cant use in css without undocumented modification just opens up unnecessary issues

avatar dgrammatiko
dgrammatiko - comment - 8 Aug 2023

Allowing a user to add a class in html that they cant use in css without undocumented modification just opens up unnecessary issues

On top of that @ is reserved for the @{ident} return ATKEYWORD; ATRULE (eg @media, @container, @Style, etc) which is a special function. Allowing escaped @ inside a class feels like allowing $ inside a PHP variable, which might be fine but common sense probably repels people from these scenarios...

avatar SniperSister
SniperSister - comment - 8 Aug 2023

The @ is a reserved sign in CSS, not in HTML attributes - and that's the usecase that we are talking about here.

avatar dgrammatiko
dgrammatiko - comment - 8 Aug 2023

HTML attributes should allow @ either for the name of the attribute (eg frameworks use @click to shortcut onclick) or for the value. Sorry for the noise

avatar richard67
richard67 - comment - 10 Aug 2023

Let’s hope that the email cloaking plugin will not cloak such markup ?

avatar wilsonge wilsonge - change - 16 Aug 2023
Title
[4.3] Allow @ sign in css identifiers
[4.4] Allow @ sign in css identifiers
avatar wilsonge wilsonge - edited - 16 Aug 2023
avatar wilsonge
wilsonge - comment - 16 Aug 2023

OK So David's right if you add the escape into the CSS (as UIKit does) then it validates as HTML and doesn't directly defy the CSS 3 spec as I read it. I don't love it. But it's nominally valid syntax and used by a major template club. So I think we should just merge it.

avatar SniperSister SniperSister - change - 17 Aug 2023
Labels Added: PR-4.4-dev
Removed: PR-4.3-dev
avatar richard67
richard67 - comment - 21 Aug 2023

Has somebody verified that the email cloak plugin will not cloak markup like e.g.
<span class="something@somewhere.com">bla</span>
?

avatar MacJoom MacJoom - close - 21 Aug 2023
avatar MacJoom MacJoom - merge - 21 Aug 2023
avatar MacJoom MacJoom - change - 21 Aug 2023
Status Pending Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 2023-08-21 16:17:52
Closed_By MacJoom
avatar MacJoom
MacJoom - comment - 22 Aug 2023

Has somebody verified that the email cloak plugin will not cloak markup like e.g. <span class="something@somewhere.com">bla</span> ?

Still works - outputs the same

Add a Comment

Login with GitHub to post a comment