2024-05-12

Found this import statement in the log:
---------------------------------------------------------------
@import"https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap";
---------------------------------------------------------------
There is no space between @import and "http...
Found this `no space` case won't work in CSSObfus Core.

The problem seems to reside in this function of `CCssRelUrlFixer.class.php`
---------------------------------------------------------------
	public static function reUrlString(){
		$dq=self::reCssString(chr(34));
		$sq=self::reCssString(chr(39));
		$sdq="(?:{$sq}|{$dq})";
		$nq="(?<!['\"])([^\s'\")]+)";
		$url_nq="(?P<url_nq_o>url\(\s*)(?P<url_nq_v>{$nq})(?P<url_nq_c>\s*\))";
		$url_sdq="(?P<url_sdq_o>url\(\s*)(?P<url_sdq_v>{$sdq})(?P<url_sdq_c>\s*\))";
		$import="(?P<import_o>@import\s+)(?P<import_v>{$sdq})";
		$namespace1="(?P<namespace1_o>@namespace\s+)(?P<namespace1_v>{$sdq})";
		$namespace2="(?P<namespace2_o>@namespace\s+\w+\s+)(?P<namespace2_v>{$sdq})";
		$all="(?:{$url_nq}|{$url_sdq}|{$import}|{$namespace1}|{$namespace2})";
		return "/{$all}/su";
	}
---------------------------------------------------------------

Take a closer look at the regular expression of 
---------------------------------------------------------------
		$import="(?P<import_o>@import\s+)(?P<import_v>{$sdq})";
---------------------------------------------------------------
`@import\s+` indicates there must be at least one space
after '@import' but actally it works without any space
as long as URL is enclosed inside ' or ".

---------------------------------------------------------------
@import url;
@import url layer;
@import url layer(layer-name);
@import url layer(layer-name) supports(supports-condition);
@import url layer(layer-name) supports(supports-condition) list-of-media-queries;
@import url layer(layer-name) list-of-media-queries;
@import url supports(supports-condition);
@import url supports(supports-condition) list-of-media-queries;
@import url list-of-media-queries;
---------------------------------------------------------------

The same rule applies to @namespace

---------------------------------------------------------------
/* Default namespace */
@namespace url(XML-namespace-URL);
@namespace "XML-namespace-URL";

/* Prefixed namespace */
@namespace prefix url(XML-namespace-URL);
@namespace prefix "XML-namespace-URL";
---------------------------------------------------------------

A solution is to allow the following three to come after
@import/@namespace

(1) at lease one space
(2) '
(3) "

The regular expressions will be:

---------------------------------------------------------------
@import(?:\s+|(?=['"]))

...or...

@import(?:\s+|(?=[".chr(34).chr(39)."]))
---------------------------------------------------------------

===============================================================
TEST CODE
===============================================================
<?php

$txt="@import    http://www.phpkobo.com/";

function testRe($idx,$re,$txt){
	echo "[{$idx}]<br>";

	if(preg_match($re,$txt,$mx)){
		echo "Success : [[[<span style='color:blue'>".$mx[1]."]]]</span>";
	}else{
		echo "Fail";
	}
	echo "<hr>";
}

$re="/@import(?:\s+|(?=[".chr(34).chr(39)."]))(.*)/";
echo "RE: ".htmlspecialchars($re)."<hr>";
echo "<hr>";

testRe("space1",$re,"@import    http://www.phpkobo.com/");
testRe("space2",$re,"@import    url(http://www.phpkobo.com/)");
echo "<hr>";

testRe("no-space1",$re,"@import'http://www.phpkobo.com/'");
testRe("no-space2",$re,'@import"http://www.phpkobo.com/"');
testRe("no-space3",$re,'@import(http://www.phpkobo.com/)');
echo "<hr>";

testRe("u1",$re,'@importurl("http://www.phpkobo.com/")');
testRe("u2",$re,'@import url("http://www.phpkobo.com/")');
echo "<hr>";

?>