[malberts]

Component style values, and a card's header-style, body-style and footer-style, now get the CSS processing MediaWiki applies to inline styles in wikitext: after template expansion, they go through Sanitizer::checkCss(), in tags, parser functions and Lua (mw.bootstrap.parse) alike. Until now they reached the page unprocessed, so constructs MediaWiki removes from inline styles, such as url() or image-set(), still worked in components. Ordinary CSS still applies; a style value that uses such a construct is dropped as a whole, as in an inline style, leaving the component's built-in styles.

Human input

Goal and shape: set by @malberts: align component styles with MediaWiki's processing of inline styles, even where a page relies on what it removes. Claude made the technical design within it.

Outcome: not reviewed by a human yet. Left for you: the code, in particular whether any user-supplied style reaches the output without going through AttributeManager.

Claude's calls

• Not discussed with @malberts: the check is a new AttributeManager::CSS_VALUE kind for the four style attributes, in the one place attribute values are already validated.
• Considered by Claude, omitted:
  • Allowing url() for local files only, which MediaWiki does not allow in inline styles either.
  • Unstripping a style before the check. A style containing a strip marker, for example from {{#tag:nowiki|...}}, is now dropped as a whole, where it rendered garbled before; MediaWiki unstrips plain inline styles before its own check. Such a style is rare.

Verification evidence

Test wiki: MediaWiki 1.43.11, PHP 8.3.36, Extension:Bootstrap 6.0.0.

• ComponentStyleRenderingTest parses wikitext with the wiki's own parser. A style that template expansion turns into url(//example.org/...) renders the URL before the fix and not after it; ordinary CSS renders in both. An AttributeManagerTest case covers the check directly. Without the check, or with the check moved before template expansion, these tests fail.
• Before the fix, the tag style, parser-function style and the card's header-style, body-style and footer-style each rendered a url(//example.org/...) value; after it, none does.
• UI (Playwright): on a page with a url(//example.org/...) style on an alert and a card header, the browser requested both images before the fix and none after it. width: 300px; on another alert is kept.
• {{#invoke:}} of a module calling mw.bootstrap.parse( 'alert', ..., { style = 'background:url(//example.org/lua.png)' } ) renders the alert without the URL.
• Existing content: the wikitext of five public wikis running BootstrapComponents, read through the API (full scans of the namespaces that hold markup, search elsewhere), has no component style using a blocked construct.

_{AI-authored — Claude Code, Opus 5.5, on a Professional Wiki account}