⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 175432 in webkit


Ignore:
Timestamp:
Oct 31, 2014, 4:10:04 PM (12 years ago)
Author:
benjamin@webkit.org
Message:

Pseudo classes with an escaped parenthesis generate invalid rules
​https://bugs.webkit.org/show_bug.cgi?id=138266

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2014-10-31
Reviewed by Antti Koivisto.

Source/WebCore:

Since the functional pseudo classes are part of the list of PseudoClassAndCompatibilityElement,
they could be created by the rule

pseudo:

':' IDENT

if the parenthesis is escaped. For example, with ":not
(", the IDENT would be
"not(", CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector would
find a pseudo class type of PseudoClassNot, and the action would create an invalid
CSSSelector for a :not() without nested selector.

This patch fixes the issue by detecting the function case in
CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector().

An other solution would be to split PseudoClassAndCompatibilityElement into simple pseudo class
and functional pseudo classes. We may do that some day but at the moment it is a lot of work with
a little benefit.

Tests: fast/css/crash-on-incomplete-webkit-any.html

fast/css/pseudo-escaped-parenthesis.html
fast/selectors/invalid-functional-pseudo-class.html

  • css/CSSParserValues.cpp:

(WebCore::CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector):

LayoutTests:

  • fast/selectors/invalid-functional-pseudo-class-expected.txt: Added.
  • fast/selectors/invalid-functional-pseudo-class.html: Added.

New test for all the functional pseudo classes.

  • fast/css/crash-on-incomplete-webkit-any-expected.txt: Added.
  • fast/css/crash-on-incomplete-webkit-any.html: Added.
  • fast/css/pseudo-escaped-parenthesis-expected.txt: Added.
  • fast/css/pseudo-escaped-parenthesis.html: Added.

Those tests come from blink. Rune solved the same problem a year ago on blink
in ​https://chromiumcodereview.appspot.com/23710067
The patch is quite different because blink uses an ancient code base, but the tests
can still be useful so I included them here.

Location:
trunk
Files:
6 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r175421 r175432  
     12014-10-31  Benjamin Poulain  <bpoulain@apple.com>
     2
     3        Pseudo classes with an escaped parenthesis generate invalid rules
     4        https://bugs.webkit.org/show_bug.cgi?id=138266
     5
     6        Reviewed by Antti Koivisto.
     7
     8        * fast/selectors/invalid-functional-pseudo-class-expected.txt: Added.
     9        * fast/selectors/invalid-functional-pseudo-class.html: Added.
     10        New test for all the functional pseudo classes.
     11
     12        * fast/css/crash-on-incomplete-webkit-any-expected.txt: Added.
     13        * fast/css/crash-on-incomplete-webkit-any.html: Added.
     14        * fast/css/pseudo-escaped-parenthesis-expected.txt: Added.
     15        * fast/css/pseudo-escaped-parenthesis.html: Added.
     16        Those tests come from blink. Rune solved the same problem a year ago on blink
     17        in https://chromiumcodereview.appspot.com/23710067
     18        The patch is quite different because blink uses an ancient code base, but the tests
     19        can still be useful so I included them here.
     20
    1212014-10-31  Said Abou-Hallawa  <sabouhallawa@apple.com>
    222

  • trunk/Source/WebCore/ChangeLog

    r175427 r175432  
     12014-10-31  Benjamin Poulain  <bpoulain@apple.com>
     2
     3        Pseudo classes with an escaped parenthesis generate invalid rules
     4        https://bugs.webkit.org/show_bug.cgi?id=138266
     5
     6        Reviewed by Antti Koivisto.
     7
     8        Since the functional pseudo classes are part of the list of PseudoClassAndCompatibilityElement,
     9        they could be created by the rule
     10             pseudo:
     11                 ':' IDENT
     12        if the parenthesis is escaped. For example, with ":not\\(", the IDENT would be
     13        "not(", CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector would
     14        find a pseudo class type of PseudoClassNot, and the action would create an invalid
     15        CSSSelector for a :not() without nested selector.
     16
     17        This patch fixes the issue by detecting the function case in
     18        CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector().
     19
     20        An other solution would be to split PseudoClassAndCompatibilityElement into simple pseudo class
     21        and functional pseudo classes. We may do that some day but at the moment it is a lot of work with
     22        a little benefit.
     23
     24        Tests: fast/css/crash-on-incomplete-webkit-any.html
     25               fast/css/pseudo-escaped-parenthesis.html
     26               fast/selectors/invalid-functional-pseudo-class.html
     27
     28        * css/CSSParserValues.cpp:
     29        (WebCore::CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector):
     30
    1312014-10-31  Chris Dumez  <cdumez@apple.com>
    232

  • trunk/Source/WebCore/css/CSSParserValues.cpp

    r174535 r175432  
    209209CSSParserSelector* CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector(CSSParserString& pseudoTypeString)
    210210{
     211    if (pseudoTypeString.length() && pseudoTypeString[pseudoTypeString.length() - 1] == '(')
     212        return nullptr;
     213
    211214    PseudoClassOrCompatibilityPseudoElement pseudoType = parsePseudoClassAndCompatibilityElementString(pseudoTypeString);
    212215    if (pseudoType.pseudoClass != CSSSelector::PseudoClassUnknown) {
Note: See TracChangeset for help on using the changeset viewer.