Fix bad-string-token to return null from get_token_value()

components/DataLiberation/CSS/class-cssprocessor.php

@@ -699,20 +699,23 @@ public function get_token_value() {
 					break;
 
 				case self::TOKEN_STRING:
-				case self::TOKEN_BAD_STRING:
 				case self::TOKEN_URL:
 					// Decode and cache the string/URL value.
 					if ( null !== $this->token_value_starts_at && null !== $this->token_value_length ) {
 						$this->token_value = $this->decode_string_or_url(
 							$this->token_value_starts_at,
 							$this->token_value_length
 						);
-						$this->token_value = $this->token_value;
 					} else {
 						$this->token_value = null;
 					}
 					break;
 
+				case self::TOKEN_BAD_STRING:
+					// Bad-string-token has no associated value per the CSS spec.
+					$this->token_value = null;
+					break;
+
 				case self::TOKEN_DELIM:
 					// Delim value is the single code point.
 					$this->token_value = $this->decode_string_or_url( $this->token_starts_at, $this->token_length );

components/DataLiberation/Tests/CSSProcessorTest.php

@@ -1541,4 +1541,19 @@ public function test_ident_start_codepoint_bounds_check(): void {
 		);
 		$this->assertSame( $expected_tokens, $actual_tokens );
 	}
+
+	/**
+	 * Tests that bad-string-token returns null for get_token_value().
+	 *
+	 * Per the CSS spec, bad-string-token has no associated data.
+	 *
+	 * @see https://www.w3.org/TR/css-syntax-3/#tokenization
+	 */
+	public function test_bad_string_token_value_is_null(): void {
+		// A bad-string-token is produced when a string is broken by a newline.
+		$processor = CSSProcessor::create( "'str\ning'" );
+		$processor->next_token();
+		$this->assertSame( CSSProcessor::TOKEN_BAD_STRING, $processor->get_token_type() );
+		$this->assertNull( $processor->get_token_value() );
+	}
 }