Changeset 109807 in webkit

Timestamp:

Mar 5, 2012 3:31:50 PM (12 years ago)

Author:

mihnea@adobe.com

Message:

[CSSRegions][CSSOM]Prevent creation of NamedFlow object for invalid flow name
​https://bugs.webkit.org/show_bug.cgi?id=79685

Reviewed by David Hyatt.

Asking for a named flow with an invalid flow name should return a null object.

Source/WebCore:

Test: fast/regions/webkit-named-flow-invalid-name.html

• css/CSSParser.cpp:

(WebCore::CSSParser::parseFlowThread):
(WebCore):

• css/CSSParser.h:
• dom/Document.cpp:

(WebCore::validFlowName):
(WebCore):
(WebCore::Document::webkitGetFlowByName):

LayoutTests:

• fast/regions/webkit-named-flow-invalid-name-expected.txt: Added.
• fast/regions/webkit-named-flow-invalid-name.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/regions/webkit-named-flow-invalid-name-expected.txt (added)
• LayoutTests/fast/regions/webkit-named-flow-invalid-name.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/CSSParser.cpp (modified) (1 diff)
• Source/WebCore/css/CSSParser.h (modified) (1 diff)
• Source/WebCore/dom/Document.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-03-05  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions][CSSOM]Prevent creation of NamedFlow object for invalid flow name
+        https://bugs.webkit.org/show_bug.cgi?id=79685
+
+        Reviewed by David Hyatt.
+
+        Asking for a named flow with an invalid flow name should return a null object.
+
+        * fast/regions/webkit-named-flow-invalid-name-expected.txt: Added.
+        * fast/regions/webkit-named-flow-invalid-name.html: Added.
+
 2012-03-02  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-03-05  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions][CSSOM]Prevent creation of NamedFlow object for invalid flow name
+        https://bugs.webkit.org/show_bug.cgi?id=79685
+
+        Reviewed by David Hyatt.
+
+        Asking for a named flow with an invalid flow name should return a null object.
+
+        Test: fast/regions/webkit-named-flow-invalid-name.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFlowThread):
+        (WebCore):
+        * css/CSSParser.h:
+        * dom/Document.cpp:
+        (WebCore::validFlowName):
+        (WebCore):
+        (WebCore::Document::webkitGetFlowByName):
+
 2012-03-05  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/css/CSSParser.cpp

@@ -7109 +7109 @@
 }
 
-// auto | <ident>
+bool CSSParser::parseFlowThread(const String& flowName, Document* doc)
+{
+    ASSERT(doc);
+    ASSERT(doc->cssRegionsEnabled());
+
+    RefPtr<CSSStyleSheet> dummyStyleSheet = CSSStyleSheet::create(doc);
+    setStyleSheet(dummyStyleSheet.get());
+
+    setupParser("@-webkit-decls{-webkit-flow-into:", flowName, "}");
+    cssyyparse(this);
+
+    m_rule = 0;
+
+    return (m_numParsedProperties && m_parsedProperties[0]->m_id == CSSPropertyWebkitFlowInto);
+}
+
+// none | <ident>
 bool CSSParser::parseFlowThread(int propId, bool important)
 {

trunk/Source/WebCore/css/CSSParser.h

@@ -216 +216 @@
 
     bool cssRegionsEnabled() const;
+    bool parseFlowThread(const String& flowName, Document*);
     bool parseFlowThread(int propId, bool important);
     bool parseRegionThread(int propId, bool important);

trunk/Source/WebCore/dom/Document.cpp

@@ -34 +34 @@
 #include "Attribute.h"
 #include "CDATASection.h"
+#include "CSSParser.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSStyleSelector.h"
@@ -1021 +1022 @@
 }
 
+static bool validFlowName(const String& flowName)
+{
+    if (equalIgnoringCase(flowName, "auto")
+        || equalIgnoringCase(flowName, "default")
+        || equalIgnoringCase(flowName, "inherit")
+        || equalIgnoringCase(flowName, "initial")
+        || equalIgnoringCase(flowName, "none"))
+        return false;
+    return true;
+}
+
 PassRefPtr<WebKitNamedFlow> Document::webkitGetFlowByName(const String& flowName)
 {
-    if (!cssRegionsEnabled())
+    if (!cssRegionsEnabled() || flowName.isEmpty() || !validFlowName(flowName) || !renderer())
         return 0;
-    if (!renderer())
+
+    // Make a slower check for invalid flow name
+    CSSParser p(true);
+    if (!p.parseFlowThread(flowName, this))
         return 0;
+
     if (RenderView* view = renderer()->view())
         return view->ensureRenderFlowThreadWithName(flowName)->ensureNamedFlow();