/** * User styling. * * The whole point of a MySpace profile was that you could wreck it with your * own CSS. Two independent layers exist here: * * 1. **Viewer CSS** (`#user-stylesheet`) — what *you* set in Settings. Applies * everywhere you browse and is stored locally. * 2. **Profile CSS** (`#profile-stylesheet`) — what the *account being viewed* * publishes, read from a profile field named `css` / `style` / `layout`. * Cleared on navigation so it can never leak onto another page. * * Profile CSS is untrusted third-party input, so it is filtered: no `@import`, * no `url()` pointing anywhere but https/data-images, no escaping the profile * subtree. It is CSS only — there is no path here by which a remote profile can * run script. */ const VIEWER_STYLE_ID = 'user-stylesheet' const PROFILE_STYLE_ID = 'profile-stylesheet' const STORAGE_KEY = 'plspace:viewer-css' /** Root class the profile page carries; all profile CSS is confined to it. */ export const PROFILE_SCOPE = '.profile-page' /** Field names checked, in order, for a profile's published stylesheet. */ export const CSS_FIELD_NAMES = ['css', 'style', 'layout', 'stylesheet'] /** * Get (or create) a style element, always moving it to the end of ``. * * The relocation is the important part. The app's own stylesheet is injected * into `` when the bundle loads — after the `