nl_tokens: Convert a value into the proper css writable value . The style name name should be logical ( no hyphens ) as specified in CSSProperty . isUnitlessNumber .
pl_tokens: function dangerousStyleValue ( name , value , isCustomProperty ) { // Note that we've removed escapeTextForBrowser() calls here since the // whole string will be escaped when the attribute is injected into // the markup. If you provide unsafe user data here they can inject // arbitrary CSS which may be problematic (I couldn't repro this): // https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet // http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/ // This is not an XSS hole but instead a potential CSS injection issue // which has lead to a greater discussion about how we're going to // trust URLs moving forward. See #2115901 var isEmpty = value == null || typeof value === 'boolean' || value === '' ; if ( isEmpty ) { return '' ; } if ( ! isCustomProperty && typeof value === 'number' && value !== 0 && ! ( isUnitlessNumber . hasOwnProperty ( name ) && isUnitlessNumber [ name ] ) ) { return <mask> + 'px' ; // Presumes implicit 'px' suffix for unitless numbers } return ( '' + value ) . trim ( ) ; }