feat: allow preceeding dash in css ident token

parser/v2/cssparser.go

@@ -126,7 +126,7 @@ var cssExpressionParser = parse.Func(func(pi *parse.Input) (r cssExpression, ok
 })
 
 // CSS property name parser.
-var cssPropertyNameFirst = "abcdefghijklmnopqrstuvwxyz"
+var cssPropertyNameFirst = "abcdefghijklmnopqrstuvwxyz-"
 var cssPropertyNameSubsequent = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-"
 var cssPropertyNameParser = parse.Func(func(in *parse.Input) (name string, ok bool, err error) {
 	start := in.Position()

parser/v2/cssparser_test.go

@@ -8,7 +8,7 @@ import (
 )
 
 func TestExpressionCSSPropertyParser(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		name     string
 		input    string
 		expected ExpressionCSSProperty
@@ -81,7 +81,7 @@ func TestExpressionCSSPropertyParser(t *testing.T) {
 }
 
 func TestConstantCSSPropertyParser(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		name     string
 		input    string
 		expected ConstantCSSProperty
@@ -94,6 +94,14 @@ func TestConstantCSSPropertyParser(t *testing.T) {
 				Value: "#ffffff",
 			},
 		},
+		{
+			name:  "css: single constant webkit property",
+			input: `-webkit-text-stroke-color: #ffffff;`,
+			expected: ConstantCSSProperty{
+				Name:  "-webkit-text-stroke-color",
+				Value: "#ffffff",
+			},
+		},
 	}
 	for _, tt := range tests {
 		tt := tt
@@ -114,7 +122,7 @@ func TestConstantCSSPropertyParser(t *testing.T) {
 }
 
 func TestCSSParser(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		name     string
 		input    string
 		expected CSSTemplate

safehtml/style.go

@@ -29,7 +29,7 @@ func SanitizeCSS(property, value string) (string, string) {
 // identifierPattern matches a subset of valid <ident-token> values defined in
 // https://www.w3.org/TR/css-syntax-3/#ident-token-diagram. This pattern matches all generic family name
 // keywords defined in https://drafts.csswg.org/css-fonts-3/#family-name-value.
-var identifierPattern = regexp.MustCompile(`^[a-zA-Z][-a-zA-Z]+$`)
+var identifierPattern = regexp.MustCompile(`^[-a-zA-Z]+$`)
 
 var cssPropertyNameToValueSanitizer = map[string]func(string) string{
 	"background-image":    sanitizeBackgroundImage,
@@ -124,14 +124,14 @@ const InnocuousPropertyValue = "zTemplUnsafeCSSPropertyValue"
 // Specifically, it matches string where every '*' or '/' is followed by end-of-text or a safe rune
 // (i.e. alphanumberics or runes in the set [+-.!#%_ \t]). This regex ensures that the following
 // are disallowed:
-//    * "/*" and "*/", which are CSS comment markers.
-//    * "//", even though this is not a comment marker in the CSS specification. Disallowing
-//      this string minimizes the chance that browser peculiarities or parsing bugs will allow
-//      sanitization to be bypassed.
-//    * '(' and ')', which can be used to call functions.
-//    * ',', since it can be used to inject extra values into a property.
-//    * Runes which could be matched on CSS error recovery of a previously malformed token, such as '@'
-//      and ':'. See http://www.w3.org/TR/css3-syntax/#error-handling.
+//   - "/*" and "*/", which are CSS comment markers.
+//   - "//", even though this is not a comment marker in the CSS specification. Disallowing
+//     this string minimizes the chance that browser peculiarities or parsing bugs will allow
+//     sanitization to be bypassed.
+//   - '(' and ')', which can be used to call functions.
+//   - ',', since it can be used to inject extra values into a property.
+//   - Runes which could be matched on CSS error recovery of a previously malformed token, such as '@'
+//     and ':'. See http://www.w3.org/TR/css3-syntax/#error-handling.
 var safeRegularPropertyValuePattern = regexp.MustCompile(`^(?:[*/]?(?:[0-9a-zA-Z+-.!#%_ \t]|$))*$`)
 
 // safeEnumPropertyValuePattern matches strings that are safe to use as enumerated property values.

safehtml/style_test.go

@@ -3,7 +3,7 @@ package safehtml
 import "testing"
 
 func TestSanitizeCSS(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		name             string
 		inputProperty    string
 		expectedProperty string
@@ -199,6 +199,13 @@ func TestSanitizeCSS(t *testing.T) {
 			inputValue:       `url("http://safe.example.com/img.png"), url("https://safe.example.com/other.png")`,
 			expectedValue:    `url("http://safe.example.com/img.png"), url("https://safe.example.com/other.png")`,
 		},
+		{
+			name:             "-webkit-text-stroke-color safe webkit",
+			inputProperty:    "-webkit-text-stroke-color",
+			expectedProperty: "-webkit-text-stroke-color",
+			inputValue:       `#000`,
+			expectedValue:    `#000`,
+		},
 		{
 			name:             "escape attempt property name",
 			inputProperty:    "</style><script>alert('hello')</script><style>",