RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-30 14:38:12 +00:00
Code Issues Activity Actions

LibWeb: Reject invalid background-repeat values instead of crashing

Browse source
This commit is contained in:
Idan Horowitz 2022-06-03 20:10:18 +03:00 • committed by Linus Groh
parent 56ec781aea
commit 34e193afa6
1 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
View file

@ -3660,7 +3660,7 @@ RefPtr<StyleValue> Parser::parse_single_background_repeat_value(TokenStream<Comp
return value_id == ValueID::RepeatX || value_id == ValueID::RepeatY; return value_id == ValueID::RepeatX || value_id == ValueID::RepeatY;
}; };
auto as_repeat = [](ValueID identifier) { auto as_repeat = [](ValueID identifier) -> Optional<Repeat> {
switch (identifier) { switch (identifier) {
case ValueID::NoRepeat: case ValueID::NoRepeat:
return Repeat::NoRepeat; return Repeat::NoRepeat;
@ -3671,7 +3671,7 @@ RefPtr<StyleValue> Parser::parse_single_background_repeat_value(TokenStream<Comp
case ValueID::Space: case ValueID::Space:
return Repeat::Space; return Repeat::Space;
default: default:
VERIFY_NOT_REACHED(); return {};
} }
}; };
@ -3689,20 +3689,29 @@ RefPtr<StyleValue> Parser::parse_single_background_repeat_value(TokenStream<Comp
value_id == ValueID::RepeatX ? Repeat::NoRepeat : Repeat::Repeat); value_id == ValueID::RepeatX ? Repeat::NoRepeat : Repeat::Repeat);
} }
auto x_repeat = as_repeat(x_value->to_identifier());
if (!x_repeat.has_value())
return nullptr;
// See if we have a second value for Y // See if we have a second value for Y
auto& second_token = tokens.peek_token(); auto& second_token = tokens.peek_token();
auto maybe_y_value = parse_css_value(second_token); auto maybe_y_value = parse_css_value(second_token);
if (!maybe_y_value || !property_accepts_value(PropertyID::BackgroundRepeat, *maybe_y_value)) { if (!maybe_y_value || !property_accepts_value(PropertyID::BackgroundRepeat, *maybe_y_value)) {
// We don't have a second value, so use x for both // We don't have a second value, so use x for both
transaction.commit(); transaction.commit();
return BackgroundRepeatStyleValue::create(as_repeat(x_value->to_identifier()), as_repeat(x_value->to_identifier())); return BackgroundRepeatStyleValue::create(x_repeat.value(), x_repeat.value());
} }
tokens.next_token(); tokens.next_token();
auto y_value = maybe_y_value.release_nonnull(); auto y_value = maybe_y_value.release_nonnull();
if (is_directional_repeat(*y_value)) if (is_directional_repeat(*y_value))
return nullptr; return nullptr;
auto y_repeat = as_repeat(y_value->to_identifier());
if (!y_repeat.has_value())
return nullptr;
transaction.commit(); transaction.commit();
return BackgroundRepeatStyleValue::create(as_repeat(x_value->to_identifier()), as_repeat(y_value->to_identifier())); return BackgroundRepeatStyleValue::create(x_repeat.value(), y_repeat.value());
} }
RefPtr<StyleValue> Parser::parse_single_background_size_value(TokenStream<ComponentValue>& tokens) RefPtr<StyleValue> Parser::parse_single_background_size_value(TokenStream<ComponentValue>& tokens)