Fix false positives in UNC path detection for HTML with backslashes

The broad `\\` entry in `$unsafeProtocols` matched any double backslash
in HTML via `str_contains`, causing false positives with TailwindCSS
compiled output (e.g. `hover\:flex`). Replace with a targeted regex
that only blocks `\\` followed by local addresses.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: freekmurze

src/Browsershot.php

@@ -76,7 +76,6 @@ class Browsershot
         'file:\\',
         'file:\\\\',
         'view-source',
-        '\\\\',
     ];
 
     /** @var array<string,string> */
@@ -345,6 +344,10 @@ public function setHtml(string $html): static
             if (preg_match('#//\s*(localhost[/:\s]|127\.|0\.0\.0\.0[/:\s]|\[::1][/:\s]|::1[/:\s])#i', $content)) {
                 throw HtmlIsNotAllowedToContainFile::make();
             }
+
+            if (preg_match('#\\\\\\\\\s*(localhost[/\\\\\s]|127\.|0\.0\.0\.0[/\\\\\s]|\[::1][/\\\\\s]|::1[/\\\\\s])#i', $content)) {
+                throw HtmlIsNotAllowedToContainFile::make();
+            }
         }
 
         $this->html = $html;

tests/BrowsershotTest.php

@@ -79,6 +79,8 @@
 })->throws(HtmlIsNotAllowedToContainFile::class)->with([
     '<iframe src="\\\\localhost/etc/passwd">',
     '<iframe src="\\\\127.0.0.1/etc/passwd">',
+    '<iframe src="\\\\0.0.0.0/etc/passwd">',
+    '<iframe src="\\\\[::1]/etc/passwd">',
 ]);
 
 it('will not allow html to contain protocol-relative urls to local addresses', function (string $html) {
@@ -97,6 +99,16 @@
     expect($browsershot)->toBeInstanceOf(Browsershot::class);
 });
 
+it('will allow html containing backslashes in css', function (string $html) {
+    $browsershot = Browsershot::html($html);
+
+    expect($browsershot)->toBeInstanceOf(Browsershot::class);
+})->with([
+    '<style>.hover\:flex { display: flex; }</style>',
+    '<style>.md\:grid-cols-2 { grid-template-columns: repeat(2, minmax(0, 1fr)); }</style>',
+    '<style>.content::before { content: "\25B6"; }</style>',
+]);
+
 it('no redirects - will not follow redirects', function () {
     $targetPath = __DIR__.'/temp/redirect_fail.pdf';