Imported styles are in the wrong order regarding non-imported styles

[spassarop]

When embedStyleSheets is true and there are imported styles with @import, the imported style result is at the end. This means that if there is a style tag like this:

<style type='text/css'>
	@import url(https://owasp.org/www--site-theme/assets/css/styles.css);
	h1 {font: 15pt "Arial"; color: blue;}
</style>

Results are like:

<style type="text/css"><![CDATA[h1 {
	font: 15.0pt Arial;
	color: blue;
}
*.hide-el {
...
}
*.remove-el {
...
}
]]></style>

Leaving the h1 style at the beginning when it should be at the end to override any previously defined style for that element in the imported style sheet.

Current behavior is:

1. The CSS parser first reads and validates the whole style tag.
2. In the process, when it finds an import tag, it validates the URL and stores it for future processing.
3. After getting a result for the styles (without imports), AntiSamy iterates over the import URLs and for each one downloads the corresponding CSS file, parses it, validates it and appends the result in the previous one which holds the accumulated validated styles.
   A way to change the order to prepend imported styles should be found, but also respecting the import order.

[davewichers]

@spassarop - This has been open for several months. Is this fixable? (Easily?).

[spassarop]

This was fixed with #114, the imports are now in the right order.

[davewichers]

This fix will be included in the 1.6.5 release.

[spassarop]

Sorry for closing, I better leave that to you hehe

[davewichers]

No problem. I keep 'fixes' like this open so I know what to report in the release notes as fixed AND so anyone coming here can find the open issue and know it is still open in the latest release.

[kwwall]

You could also look at the issues by date range. That's what I do. Leaving issues open is confusing to anyone who may want to contribute to your project. But YMMV.

…

-kevin

On Fri, Dec 31, 2021, 2:54 PM Dave Wichers ***@***.***> wrote: No problem. I keep 'fixes' like this open so I know what to report in the release notes as fixed AND so anyone coming here can find the open issue and know it is still open in the latest release. — Reply to this email directly, view it on GitHub <#113 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAO6PGY62OWJZMXOKCC4FX3UTYDAHANCNFSM5GSMMOVQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[davewichers]

Closing this issue as these changes went out with the 1.6.5 release I just pushed.