| @@ -266,8 +266,10 @@ | ||
| 266 | 266 | if ( '' === $css ) { |
| 267 | 267 | continue; |
| 268 | 268 | } |
| 269 | 269 | |
| 270 | + $css = self::sanitize_css( $css ); | |
| 271 | + | |
| 270 | 272 | if ( 'base' === ( $device['value'] ?? '' ) ) { |
| 271 | 273 | $output .= $css; |
| 272 | 274 | } else { |
| 273 | 275 | $output .= "@media ({$device['direction']}-width:{$device['value']}px){{$css}}"; |
| @@ -274,10 +276,19 @@ | ||
| 274 | 276 | } |
| 275 | 277 | } |
| 276 | 278 | |
| 277 | 279 | if ( ! empty( $css_map['customStyles'] ) ) { |
| 278 | - $output .= $css_map['customStyles']; | |
| 280 | + $output .= self::sanitize_css( $css_map['customStyles'] ); | |
| 279 | 281 | } |
| 280 | 282 | |
| 281 | 283 | return $output; |
| 284 | + } | |
| 285 | + | |
| 286 | + /** | |
| 287 | + * Strips any HTML-tag-like sequences from a stored CSS string before it's | |
| 288 | + * @param string $css Raw CSS string from a block attribute. | |
| 289 | + * @return string Sanitized CSS string. | |
| 290 | + */ | |
| 291 | + private static function sanitize_css( string $css ): string { | |
| 292 | + return preg_replace( '/<[^>]*>?/', '', $css ); | |
| 282 | 293 | } |
| 283 | 294 | } |
