WP_REST_Global_Styles_Controller::validate_custom_css( mixed $css ): true|WP_Error

683	protected function validate_custom_css( $css ) {684		if ( ! is_string( $css ) ) {685			return new WP_Error(686				'rest_custom_css_invalid_type',687				__( 'CSS must be a string.' ),688				array( 'status' => 400 )689			);690		}691 692		$length = strlen( $css );693		for (694			$at = strcspn( $css, '<' );695			$at < $length;696			$at += strcspn( $css, '<', ++$at )697		) {698			$remaining_strlen = $length - $at;699			/**700			 * Custom CSS text is expected to render inside an HTML STYLE element.701			 * A STYLE closing tag must not appear within the CSS text because it702			 * would close the element prematurely.703			 *704			 * The text must also *not* end with a partial closing tag (e.g., `<`,705			 * `</`, … `</style`) because subsequent styles which are concatenated706			 * could complete it, forming a valid `</style>` tag.707			 *708			 * Example:709			 *710			 *     $style_a = 'p { font-weight: bold; </sty';711			 *     $style_b = 'le> gotcha!';712			 *     $combined = "{$style_a}{$style_b}";713			 *714			 *     $style_a = 'p { font-weight: bold; </style';715			 *     $style_b = 'p > b { color: red; }';716			 *     $combined = "{$style_a}\n{$style_b}";717			 *718			 * Note how in the second example, both of the style contents are benign719			 * when analyzed on their own. The first style was likely the result of720			 * improper truncation, while the second is perfectly sound. It was only721			 * through concatenation that these two styles combined to form content722			 * that would have broken out of the containing STYLE element, thus723			 * corrupting the page and potentially introducing security issues.724			 *725			 * @link https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state726			 */727			$possible_style_close_tag = 0 === substr_compare(728				$css,729				'</style',730				$at,731				min( 7, $remaining_strlen ),732				true733			);734			if ( $possible_style_close_tag ) {735				if ( $remaining_strlen < 8 ) {736					return new WP_Error(737						'rest_custom_css_illegal_markup',738						sprintf(739							/* translators: %s is the CSS that was provided. */740							__( 'The CSS must not end in "%s".' ),741							esc_html( substr( $css, $at ) )742						),743						array( 'status' => 400 )744					);745				}746 747				if ( 1 === strspn( $css, " \t\f\r\n/>", $at + 7, 1 ) ) {748					return new WP_Error(749						'rest_custom_css_illegal_markup',750						sprintf(751							/* translators: %s is the CSS that was provided. */752							__( 'The CSS must not contain "%s".' ),753							esc_html( substr( $css, $at, 8 ) )754						),755						array( 'status' => 400 )756					);757				}758			}759		}760 761		return true;762	}