From b33f094b00ae29a7425fc328c047bb135b1eea3a Mon Sep 17 00:00:00 2001
From: Brian Wolff <bawolff+wn@gmail.com>
Date: Fri, 6 Dec 2024 13:54:06 -0800
Subject: [PATCH] Ensure that < and alphabetical tokens are separated

In foreign content, the rules for <style> tags are different. A
< followed by an alphabetical character creates a child tag even
in a <style> tag. Ensure that a < delimiter is separated from
any token that can be alphabetical

Bug: T381617
---
 src/Objects/Token.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/Objects/Token.php b/src/Objects/Token.php
index 30672dd..e268ad7 100644
--- a/src/Objects/Token.php
+++ b/src/Objects/Token.php
@@ -518,6 +518,8 @@ class Token extends ComponentValue {
 			'.' => [ self::T_NUMBER, self::T_PERCENTAGE, self::T_DIMENSION ],
 			'+' => [ self::T_NUMBER, self::T_PERCENTAGE, self::T_DIMENSION ],
 			'/' => [ '*' ],
+			// Not required by spec, but help prevent XSS in foreign content (T381617)
+			'<' => [ self::T_IDENT, self::T_FUNCTION, self::T_URL, self::T_BAD_URL, '!', '/' ],
 		];
 
 		$t1 = $firstToken->type === self::T_DELIM ? $firstToken->value : $firstToken->type;
-- 
2.39.2