RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-06-01 08:28:11 +00:00
Code Issues Activity Actions

LibWeb: Bail parsing transform-origin if the parsed value is null

Browse source 
Passing a value of a type different than number or length-percentage
to transform-origin returned a null pointer, and we didn't take care
of that path before.

This patch fixes a crash caused by an incorrect CSS declaration, such as
`transform-origin: "center"`.

Fixes #21609
This commit is contained in:
Karol Kosek 2023-10-29 07:58:15 +01:00 • committed by Andreas Kling
parent d22aa851cf
commit bf16ddfbb0
3 changed files with 32 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Tests/LibWeb/Text/expected/css/transform-origin-serialization.txt Normal file
View file

@ -0,0 +1,7 @@
center => 50% 50%
10px => 10px 50%
25% => 25% 50%
left 20% => 0% 20%
20px bottom => 20px 100%
top right => 100% 0%
"center" => (invalid)

23
Tests/LibWeb/Text/input/css/transform-origin-serialization.html Normal file
View file

@ -0,0 +1,23 @@
<script src="../include.js"></script>
<script>
test(() => {
function serialize(input) {
const e = document.createElement("div");
e.style.transformOrigin = input;
const serialized = e.style.transformOrigin;
println(input + " => " + (serialized === '' ? '(invalid)' : serialized));
}
for (transformOrigin of [
'center',
'10px',
'25%',
'left 20%',
'20px bottom',
'top right',
'"center"',
]) {
serialize(transformOrigin);
}
});
</script>

2
Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
View file

@ -5008,6 +5008,8 @@ RefPtr<StyleValue> Parser::parse_transform_origin_value(Vector<ComponentValue> c
};
auto to_axis_offset = [](RefPtr<StyleValue> value) -> Optional<AxisOffset> {
if (!value)
return OptionalNone {};
if (value->is_percentage())
return AxisOffset { Axis::None, value->as_percentage() };
if (value->is_length())