Prechádzať zdrojové kódy

LibWeb: Fix infinite loop in CSS::Parser::parse_transition_value()

Matthew Olsson 1 rok pred
rodič
commit
87155c7b1d

+ 1 - 0
Tests/LibWeb/Text/expected/WebAnimations/transitions/parse-transition-property.txt

@@ -0,0 +1 @@
+   PASS! (Did not crash/timeout)

+ 15 - 0
Tests/LibWeb/Text/input/WebAnimations/transitions/parse-transition-property.html

@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<style>
+    #foo {
+        transition: background-color 1s 2s linear,
+            opacity,
+            this is an invalid property value;
+    }
+</style>
+<div id="foo"></div>
+<script src="../../include.js"></script>
+<script>
+    test(() => {
+        println("PASS! (Did not crash/timeout)");
+    });
+</script>

+ 14 - 8
Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp

@@ -5367,6 +5367,16 @@ RefPtr<StyleValue> Parser::parse_transition_value(TokenStream<ComponentValue>& t
                 continue;
                 continue;
             }
             }
 
 
+            if (auto easing = parse_easing_value(tokens)) {
+                if (transition.easing) {
+                    dbgln_if(CSS_PARSER_DEBUG, "Transition property has multiple easing values");
+                    return {};
+                }
+
+                transition.easing = easing->as_easing();
+                continue;
+            }
+
             if (tokens.peek_token().is(Token::Type::Ident)) {
             if (tokens.peek_token().is(Token::Type::Ident)) {
                 if (transition.property_name) {
                 if (transition.property_name) {
                     dbgln_if(CSS_PARSER_DEBUG, "Transition property has multiple property identifiers");
                     dbgln_if(CSS_PARSER_DEBUG, "Transition property has multiple property identifiers");
@@ -5376,16 +5386,12 @@ RefPtr<StyleValue> Parser::parse_transition_value(TokenStream<ComponentValue>& t
                 auto ident = tokens.next_token().token().ident();
                 auto ident = tokens.next_token().token().ident();
                 if (auto property = property_id_from_string(ident); property.has_value())
                 if (auto property = property_id_from_string(ident); property.has_value())
                     transition.property_name = CustomIdentStyleValue::create(ident);
                     transition.property_name = CustomIdentStyleValue::create(ident);
-            }
 
 
-            if (auto easing = parse_easing_value(tokens)) {
-                if (transition.easing) {
-                    dbgln_if(CSS_PARSER_DEBUG, "Transition property has multiple easing values");
-                    return {};
-                }
-
-                transition.easing = easing->as_easing();
+                continue;
             }
             }
+
+            dbgln_if(CSS_PARSER_DEBUG, "Transition property has unexpected token \"{}\"", tokens.peek_token().to_string());
+            return {};
         }
         }
 
 
         if (!transition.property_name)
         if (!transition.property_name)