phacility/phabricator · warning · Exception

Monospaced font value "%s" is unsafe. You may only enter let

Error message

Monospaced font value "%s" is unsafe. You may only enter letters, numbers, spaces, commas, periods, hyphens, forward slashes, and double quotes

What it means

The monospaced font preference accepts only a CSS font shorthand built from a whitelist: letters, digits, spaces, commas, periods, hyphens, forward slashes, and double quotes. filterMonospacedCSSRule() strips everything else, and validateTransactionValue() throws when the filtered result differs from the input - i.e. the submitted value contained disallowed characters. This blocks CSS injection through the settings panel.

Source

Thrown at src/applications/settings/setting/PhabricatorMonospacedFontSetting.php:34

  protected function getSettingOrder() {
    return 500;
  }

  protected function getControlInstructions() {
    return pht(
      'You can customize the font used when showing monospaced text, '.
      'including source code. You should enter a valid CSS font declaration '.
      'like: `13px Consolas`');
  }

  public function validateTransactionValue($value) {
    if (!strlen($value)) {
      return;
    }

    $filtered = self::filterMonospacedCSSRule($value);
    if ($filtered !== $value) {
      throw new Exception(
        pht(
          'Monospaced font value "%s" is unsafe. You may only enter '.
          'letters, numbers, spaces, commas, periods, hyphens, '.
          'forward slashes, and double quotes',
          $value));
    }
  }

  public static function filterMonospacedCSSRule($monospaced) {
    // Prevent the user from doing dangerous things.
    return preg_replace('([^a-z0-9 ,"./-]+)i', '', $monospaced);
  }

}

View on GitHub (pinned to 5720a38cfe)

Solutions

Submit only the font shorthand: size then family list, e.g. `13px "Courier New", monospace`
Use double quotes for multiword font names - single quotes are stripped and trigger the error
Remove property names, semicolons, colons, parentheses, and braces entirely

Example fix

// before
13px 'Courier New'; font-weight: bold;

// after
13px "Courier New", monospace

Defensive patterns

Strategy: validation

Validate before calling

// Mirror the server-side whitelist before saving
$filtered = preg_replace('([^a-z0-9 ,"./-]+)i', '', $value);
if ($filtered !== $value) {
  // reject client-side: value contains characters outside the allowed set
}

Type guard

function isSafeMonospacedFontValue($v) {
  if (!strlen($v)) { return true; } // empty = default, allowed
  return preg_replace('([^a-z0-9 ,"./-]+)i', '', $v) === $v;
}

Try / catch

try {
  // apply settings transaction
} catch (Exception $ex) {
  // sanitize or blank the font value, then resubmit
}

Prevention

Enter only the font shorthand: size followed by family list
Use double quotes for multiword fonts; never single quotes
No property names, semicolons, colons, parentheses, or braces
Validate against the whitelist in the UI before POSTing

When it happens

Trigger: Saving Settings > Display > Monospaced Font with values containing single quotes ('13px \'Courier New\''), semicolons or colons ('font-family: Consolas;'), parentheses, braces, or url()/escape syntax - anything outside the whitelist.

Common situations: Pasting a full CSS rule instead of a font shorthand; single-quoting multiword font names out of habit; trying to smuggle in extra properties like font-weight or line-height via declarations.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/64ba6bb1e8ae5a7c. Report an issue: GitHub.