Changeset 255151 in webkit

Timestamp:

Jan 27, 2020, 9:40:42 AM (5 years ago)

Author:

Antti Koivisto

Message:

Correct VTT Cue Style handling to match the specification
​https://bugs.webkit.org/show_bug.cgi?id=201086
<rdar://problem/54658121>

Reviewed by Brent Fulgham.

The VTT specification requires that only data-URLs are permitted in STYLE blocks.

• css/CSSSelector.cpp:

(WebCore::CSSSelector::selectorText const):

Fix selectorText for function version of ::cue().

• css/parser/CSSParserContext.cpp:

(WebCore::CSSParserContext::completeURL const):

Don't allow non-data URLs in WebVTT parser mode.

• css/parser/CSSParserContext.h:

(WebCore::CSSParserContext::completeURL const): Deleted.

• css/parser/CSSParserMode.h:

(WebCore::isStrictParserMode):

• html/track/WebVTTParser.cpp:

(WebCore::WebVTTParser::collectStyleSheet):
(WebCore::WebVTTParser::checkAndStoreStyleSheet):

Instead of simply validating the original stylesheet, build a new sanitized stylesheet text
from the stylesheet parsed in WebVTT mode. This sanitized stylesheet is then used as the
input for the style system.

• html/track/WebVTTParser.h:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• css/CSSSelector.cpp (modified) (1 diff)
• css/parser/CSSParserContext.cpp (modified) (2 diffs)
• css/parser/CSSParserContext.h (modified) (2 diffs)
• css/parser/CSSParserMode.h (modified) (3 diffs)
• html/track/WebVTTParser.cpp (modified) (4 diffs)
• html/track/WebVTTParser.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-01-27  Antti Koivisto  <antti@apple.com>
+
+        Correct VTT Cue Style handling to match the specification
+        https://bugs.webkit.org/show_bug.cgi?id=201086
+        <rdar://problem/54658121>
+
+        Reviewed by Brent Fulgham.
+
+        The VTT specification requires that only data-URLs are permitted in STYLE blocks.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::selectorText const):
+
+        Fix selectorText for function version of ::cue().
+
+        * css/parser/CSSParserContext.cpp:
+        (WebCore::CSSParserContext::completeURL const):
+
+        Don't allow non-data URLs in WebVTT parser mode.
+
+        * css/parser/CSSParserContext.h:
+        (WebCore::CSSParserContext::completeURL const): Deleted.
+        * css/parser/CSSParserMode.h:
+        (WebCore::isStrictParserMode):
+        * html/track/WebVTTParser.cpp:
+        (WebCore::WebVTTParser::collectStyleSheet):
+        (WebCore::WebVTTParser::checkAndStoreStyleSheet):
+
+        Instead of simply validating the original stylesheet, build a new sanitized stylesheet text
+        from the stylesheet parsed in WebVTT mode. This sanitized stylesheet is then used as the
+        input for the style system.
+
+        * html/track/WebVTTParser.h:
+
 2020-01-27  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/css/CSSSelector.cpp

@@ -737 +737 @@
                     builder.appendLiteral("::-webkit-input-placeholder");
                 break;
+            case CSSSelector::PseudoElementCue: {
+                if (auto* selectorList = cs->selectorList()) {
+                    builder.appendLiteral("::cue(");
+                    selectorList->buildSelectorsText(builder);
+                    builder.append(')');
+                } else
+                    builder.appendLiteral("::cue");
+                break;
+            }
             default:
                 builder.appendLiteral("::");

trunk/Source/WebCore/css/parser/CSSParserContext.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2018-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -106 +106 @@
 }
 
+URL CSSParserContext::completeURL(const String& url) const
+{
+    auto completedURL = [&] {
+        if (url.isNull())
+            return URL();
+        if (charset.isEmpty())
+            return URL(baseURL, url);
+        TextEncoding encoding(charset);
+        auto& encodingForURLParsing = encoding.encodingForFormSubmissionOrURLParsing();
+        return URL(baseURL, url, encodingForURLParsing == UTF8Encoding() ? nullptr : &encodingForURLParsing);
+    }();
+
+    if (mode == WebVTTMode && !completedURL.protocolIsData())
+        return URL();
+
+    return completedURL;
 }
+
+}

trunk/Source/WebCore/css/parser/CSSParserContext.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2018-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -73 +73 @@
     bool useSystemAppearance { false };
 
-    URL completeURL(const String& url) const
-    {
-        if (url.isNull())
-            return URL();
-        if (charset.isEmpty())
-            return URL(baseURL, url);
-        TextEncoding encoding(charset);
-        auto& encodingForURLParsing = encoding.encodingForFormSubmissionOrURLParsing();
-        return URL(baseURL, url, encodingForURLParsing == UTF8Encoding() ? nullptr : &encodingForURLParsing);
-    }
+    URL completeURL(const String& url) const;
 
     bool isContentOpaque { false };

trunk/Source/WebCore/css/parser/CSSParserMode.h

@@ -1 +1 @@
 /*
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
- * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -43 +43 @@
     CSSViewportRuleMode,
     // User agent stylesheets are parsed in standards mode but also allows internal properties and values.
-    UASheetMode
+    UASheetMode,
+    // WebVTT places limitations on external resources.
+    WebVTTMode
 };
 
@@ -74 +76 @@
 inline bool isStrictParserMode(CSSParserMode cssParserMode)
 {
-    return cssParserMode == UASheetMode || cssParserMode == HTMLStandardMode || cssParserMode == SVGAttributeMode;
+    switch (cssParserMode) {
+    case UASheetMode:
+    case HTMLStandardMode:
+    case SVGAttributeMode:
+    case WebVTTMode:
+        return true;
+    case HTMLQuirksMode:
+    case CSSViewportRuleMode:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
 }
 

trunk/Source/WebCore/html/track/WebVTTParser.cpp

@@ -2 +2 @@
  * Copyright (C) 2011, 2013 Google Inc.  All rights reserved.
  * Copyright (C) 2013 Cable Television Labs, Inc.
- * Copyright (C) 2011-2014 Apple Inc.  All rights reserved.
+ * Copyright (C) 2011-2020 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -316 +316 @@
         return checkAndRecoverCue(line);
 
-    m_currentStyleSheet.append(line);
+    m_currentSourceStyleSheet.append(line);
     return Style;
 }
@@ -372 +372 @@
         return false;
     
-    auto styleSheet = WTFMove(m_currentStyleSheet);
-    
-    auto contents = StyleSheetContents::create();
-    if (!contents->parseString(styleSheet))
+    auto styleSheetText = WTFMove(m_currentSourceStyleSheet);
+
+    // WebVTTMode disallows non-data URLs.
+    auto contents = StyleSheetContents::create(CSSParserContext(WebVTTMode));
+    if (!contents->parseString(styleSheetText))
         return true;
 
@@ -389 +390 @@
     if (!childRules.size())
         return true;
+
+    StringBuilder sanitizedStyleSheetBuilder;
     
     for (const auto& rule : childRules) {
         if (!rule->isStyleRule())
             return true;
-        const auto& styleRule = downcast<StyleRule>(rule.get());
-
-        const auto& selectorList = styleRule->selectorList();
+        const auto& styleRule = downcast<StyleRule>(*rule);
+
+        const auto& selectorList = styleRule.selectorList();
         if (selectorList.listSize() != 1)
             return true;
         auto selector = selectorList.selectorAt(0);
-        if (selector->selectorText() != "::cue")
+        auto selectorText = selector->selectorText();
+        
+        bool isCue = selectorText == "::cue" || selectorText.startsWith("::cue(");
+        if (!isCue)
             return true;
-    }
-
-    m_styleSheets.append(styleSheet);
+
+        if (styleRule.properties().isEmpty())
+            continue;
+
+        sanitizedStyleSheetBuilder.append(selectorText);
+        sanitizedStyleSheetBuilder.appendLiteral(" { ");
+        sanitizedStyleSheetBuilder.append(styleRule.properties().asText());
+        sanitizedStyleSheetBuilder.appendLiteral(" }\n");
+    }
+
+    // It would be more stylish to parse the stylesheet only once instead of serializing a sanitized version.
+    if (!sanitizedStyleSheetBuilder.isEmpty())
+        m_styleSheets.append(sanitizedStyleSheetBuilder.toString());
+
     return true;
 }

trunk/Source/WebCore/html/track/WebVTTParser.h

@@ -195 +195 @@
     String m_currentSettings;
     RefPtr<VTTRegion> m_currentRegion;
-    String m_currentStyleSheet;
+    String m_currentSourceStyleSheet;
     
     WebVTTParserClient* m_client;