WP_Customize_Custom_CSS_Setting::validate( string $value ): true|WP_Error

165	public function validate( $value ) {166		// Restores the more descriptive, specific name for use within this method.167		$css = $value;168 169		$validity = new WP_Error();170 171		$length = strlen( $css );172		for (173			$at = strcspn( $css, '<' );174			$at < $length;175			$at += strcspn( $css, '<', ++$at )176		) {177			$remaining_strlen = $length - $at;178			/**179			 * Custom CSS text is expected to render inside an HTML STYLE element.180			 * A STYLE closing tag must not appear within the CSS text because it181			 * would close the element prematurely.182			 *183			 * The text must also *not* end with a partial closing tag (e.g., `<`,184			 * `</`, … `</style`) because subsequent styles which are concatenated185			 * could complete it, forming a valid `</style>` tag.186			 *187			 * Example:188			 *189			 *     $style_a = 'p { font-weight: bold; </sty';190			 *     $style_b = 'le> gotcha!';191			 *     $combined = "{$style_a}{$style_b}";192			 *193			 *     $style_a = 'p { font-weight: bold; </style';194			 *     $style_b = 'p > b { color: red; }';195			 *     $combined = "{$style_a}\n{$style_b}";196			 *197			 * Note how in the second example, both of the style contents are benign198			 * when analyzed on their own. The first style was likely the result of199			 * improper truncation, while the second is perfectly sound. It was only200			 * through concatenation that these two styles combined to form content201			 * that would have broken out of the containing STYLE element, thus202			 * corrupting the page and potentially introducing security issues.203			 *204			 * @see https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state205			 */206			$possible_style_close_tag = 0 === substr_compare(207				$css,208				'</style',209				$at,210				min( 7, $remaining_strlen ),211				true212			);213			if ( $possible_style_close_tag ) {214				if ( $remaining_strlen < 8 ) {215					$validity->add(216						'illegal_markup',217						sprintf(218							/* translators: %s is the CSS that was provided. */219							__( 'The CSS must not end in "%s".' ),220							esc_html( substr( $css, $at ) )221						)222					);223					break;224				}225 226				if ( 1 === strspn( $css, " \t\f\r\n/>", $at + 7, 1 ) ) {227					$validity->add(228						'illegal_markup',229						sprintf(230							/* translators: %s is the CSS that was provided. */231							__( 'The CSS must not contain "%s".' ),232							esc_html( substr( $css, $at, 8 ) )233						)234					);235					break;236				}237			}238		}239 240		if ( ! $validity->has_errors() ) {241			$validity = parent::validate( $css );242		}243		return $validity;244	}