diff --git a/library/HTMLPurifier/AttrDef/CSS.php b/library/HTMLPurifier/AttrDef/CSS.php index 6a543d2f..c5314067 100644 --- a/library/HTMLPurifier/AttrDef/CSS.php +++ b/library/HTMLPurifier/AttrDef/CSS.php @@ -30,8 +30,8 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef list($property, $value) = explode(':', $declaration, 2); if (!isset($definition->info[$property])) continue; // inefficient call, since the validator will do this again - // inherit works for everything if (strtolower(trim($value)) !== 'inherit') { + // inherit works for everything (but only on the base property) $result = $definition->info[$property]->validate( $value, $config, $context ); } else { diff --git a/library/HTMLPurifier/AttrDef/Multiple.php b/library/HTMLPurifier/AttrDef/Multiple.php index d4555e3c..ca053250 100644 --- a/library/HTMLPurifier/AttrDef/Multiple.php +++ b/library/HTMLPurifier/AttrDef/Multiple.php @@ -8,6 +8,10 @@ require_once 'HTMLPurifier/AttrDef.php'; * Certain CSS properties such as border-width and margin allow multiple * lengths to be specified. This class can take a vanilla border-width * definition and multiply it, usually into a max of four. + * + * @note Even though the CSS specification isn't clear about it, inherit + * can only be used alone: it will never manifest as part of a multi + * shorthand declaration. Thus, this class does not allow inherit. */ class HTMLPurifier_AttrDef_Multiple extends HTMLPurifier_AttrDef {