in src/main/java/org/apache/sling/xss/impl/style/BatikCssCleaner.java [49:62]
public String cleanStylesheet(String untrustedCss) {
try {
if (untrustedCss.startsWith(CDATA_PRE) && untrustedCss.endsWith(CDATA_POST))
untrustedCss = untrustedCss.substring(CDATA_PRE.length(), untrustedCss.length() - CDATA_POST.length());
Parser parser = new Parser();
ValidatingDocumentHandler handler = new ValidatingDocumentHandler(cssPolicy, false);
parser.setDocumentHandler(handler);
parser.parseStyleSheet(new InputSource(new StringReader(untrustedCss)));
return handler.getValidCss();
} catch (CSSException | IOException e) {
logger.warn("Unexpected error while cleaning stylesheet", e);
return "";
}
}