freenet/fred-staging — pull request #240 by bertm (2014-06-24 22:01:13+00:00)
Title: Make the CSS content filter even safer

Public/package static mutable objects are unsafe, especially when they define which content to allow. ```CSSTokenizerFilter``` required some basic rewriting to use safer structures. Accidental modification of such static members affects the filter until the node is restarted, so we should be extra cautious in protecting our assets here.

All allowed content listings remain public (inspection may be useful for third-party tools), but are converted to immutable collections for safety.

Also, ban the ```:visited``` pseudoclass as it may leak browser history information. It allows an adversary to change how the page is displayed according to browser history, possibly luring the unsuspecting user into his trap.

Since ```CSSTokenizerFilter``` does not ignore invalid selectors but completely fails on them (for the current declaration block, that is), I had to introduce some new logic to allow banned-yet-valid selectors to be ignored.

---
_Not-so-mental note:_

1. don't make any variables static
2. if you need to make them static, make sure they are immutable and final
3. if that's impossible, at least make them private
4. if that's also impossible, rewrite the code to meet point 1