Fix CssInliner tokenizer crash on unquoted data: URLs containing parentheses

Copilot · dg · web-flow · commit 173e4687f132 · 2026-03-31T17:26:43.000Z
Agent-Logs-Url: https://github.com/nette/mail/sessions/040c9a82-923c-4f72-ab7f-3733ef611406 Co-authored-by: dg <194960+dg@users.noreply.github.com>
diff --git a/src/Mail/CssInliner.php b/src/Mail/CssInliner.php
@@ -22,7 +22,7 @@ class CssInliner
 		self::T_Comment => '/\*[^*]*\*+(?:[^/*][^*]*\*+)*/',
 		self::T_Whitespace => '[\s]+',
 		self::T_String => '"(?:[^"\\\]|\\\.)*"|\'(?:[^\'\\\]|\\\.)*\'',
-		self::T_Url => 'url\(\s*(?:"(?:[^"\\\]|\\\.)*"|\'(?:[^\'\\\]|\\\.)*\'|[^)]*?)\s*\)',
+		self::T_Url => 'url\(\s*(?:"(?:[^"\\\]|\\\.)*"|\'(?:[^\'\\\]|\\\.)*\'|(?:[^()\\\]|\\\.|\((?:[^)\\\]|\\\.)*\))*)\s*\)',
 		self::T_Escape => '\x5c[^\n\r\f]',
 		self::T_AtIdent => '@-?[a-zA-Z_][\w-]*',
 		self::T_Hash => '\#[\w-]+',
diff --git a/tests/Mail/CssInliner.phpt b/tests/Mail/CssInliner.phpt
@@ -200,6 +200,33 @@ test('data: URI in <style> tag', function () {
 });
 
 
+test('unquoted SVG data: URI with parentheses in content', function () {
+	$result = (new CssInliner)
+		->addCss("div { background-image: url(data:image/svg+xml,<svg><g transform='translate(50,50)'></g></svg>); }")
+		->inline('<html><body><div>X</div></body></html>');
+
+	Assert::contains("background-image: url(data:image/svg+xml,<svg><g transform='translate(50,50)'></g></svg>)", $result);
+});
+
+
+test('unquoted SVG data: URI with rgba() in content', function () {
+	$result = (new CssInliner)
+		->addCss("div { background-image: url(data:image/svg+xml,<svg><rect fill='rgba(255,0,0,0.5)'/></svg>); }")
+		->inline('<html><body><div>X</div></body></html>');
+
+	Assert::contains("background-image: url(data:image/svg+xml,<svg><rect fill='rgba(255,0,0,0.5)'/></svg>)", $result);
+});
+
+
+test('unquoted SVG data: URI with url() reference in content', function () {
+	$result = (new CssInliner)
+		->addCss("div { background-image: url(data:image/svg+xml,<svg><rect fill='url(#grad)'/></svg>); }")
+		->inline('<html><body><div>X</div></body></html>');
+
+	Assert::contains("background-image: url(data:image/svg+xml,<svg><rect fill='url(#grad)'/></svg>)", $result);
+});
+
+
 test('braces inside string values in stylesheet', function () {
 	$result = (new CssInliner)->inline(
 		'<html><head><style>.a { content: "{hello}"; color: red; } .b { margin: 0; }</style></head><body><p class="b">X</p></body></html>',
