From 632fc73643c5edc9c1bcb16f7487117463220781 Mon Sep 17 00:00:00 2001
From: Tim Ledbetter <tim.ledbetter@ladybird.org>
Date: Wed, 12 Mar 2025 13:51:19 +0000
Subject: [PATCH] LibWeb/CSS: Don't allow negative border radius in
 `box-shadow` property

---
 .../LibWeb/CSS/Parser/PropertyParsing.cpp     |  4 ++
 .../parsing/box-shadow-invalid.txt            | 45 +++++++++++++
 .../parsing/box-shadow-invalid.html           | 66 +++++++++++++++++++
 3 files changed, 115 insertions(+)
 create mode 100644 Tests/LibWeb/Text/expected/wpt-import/css/css-backgrounds/parsing/box-shadow-invalid.txt
 create mode 100644 Tests/LibWeb/Text/input/wpt-import/css/css-backgrounds/parsing/box-shadow-invalid.html

diff --git a/Libraries/LibWeb/CSS/Parser/PropertyParsing.cpp b/Libraries/LibWeb/CSS/Parser/PropertyParsing.cpp
index 00cebe37399..9ee58e236ba 100644
--- a/Libraries/LibWeb/CSS/Parser/PropertyParsing.cpp
+++ b/Libraries/LibWeb/CSS/Parser/PropertyParsing.cpp
@@ -1816,6 +1816,10 @@ RefPtr<CSSStyleValue> Parser::parse_single_shadow_value(TokenStream<ComponentVal
             if (!maybe_blur_radius)
                 continue;
             blur_radius = maybe_blur_radius;
+            if (blur_radius->is_length() && blur_radius->as_length().length().raw_value() < 0)
+                return nullptr;
+            if (blur_radius->is_percentage() && blur_radius->as_percentage().value() < 0)
+                return nullptr;
             tokens.discard_a_token();
 
             // spread distance (optional)
diff --git a/Tests/LibWeb/Text/expected/wpt-import/css/css-backgrounds/parsing/box-shadow-invalid.txt b/Tests/LibWeb/Text/expected/wpt-import/css/css-backgrounds/parsing/box-shadow-invalid.txt
new file mode 100644
index 00000000000..b2083ed2b53
--- /dev/null
+++ b/Tests/LibWeb/Text/expected/wpt-import/css/css-backgrounds/parsing/box-shadow-invalid.txt
@@ -0,0 +1,45 @@
+Harness status: OK
+
+Found 40 tests
+
+40 Pass
+Pass	e.style['box-shadow'] = "auto" should not set the property value
+Pass	e.style['box-shadow'] = "1 2" should not set the property value
+Pass	e.style['box-shadow'] = "1% 2%" should not set the property value
+Pass	e.style['box-shadow'] = "1px calc(2px + 2%)" should not set the property value
+Pass	e.style['box-shadow'] = "1px" should not set the property value
+Pass	e.style['box-shadow'] = "1px 2px 3px 4px 5px" should not set the property value
+Pass	e.style['box-shadow'] = "red 1px 2px blue" should not set the property value
+Pass	e.style['box-shadow'] = "red" should not set the property value
+Pass	e.style['box-shadow'] = "4px red" should not set the property value
+Pass	e.style['box-shadow'] = "red 4px" should not set the property value
+Pass	e.style['box-shadow'] = "-4px red 4px" should not set the property value
+Pass	e.style['box-shadow'] = "red -4px 4px red" should not set the property value
+Pass	e.style['box-shadow'] = "-4px 4px red 0" should not set the property value
+Pass	e.style['box-shadow'] = "-4px 4px 0 red 0" should not set the property value
+Pass	e.style['box-shadow'] = "inset" should not set the property value
+Pass	e.style['box-shadow'] = "inset 4px" should not set the property value
+Pass	e.style['box-shadow'] = "4px inset" should not set the property value
+Pass	e.style['box-shadow'] = "4px inset -4px" should not set the property value
+Pass	e.style['box-shadow'] = "inset 4px -4px inset" should not set the property value
+Pass	e.style['box-shadow'] = "4px -4px inset 0" should not set the property value
+Pass	e.style['box-shadow'] = "4px -4px 0 inset 0" should not set the property value
+Pass	e.style['box-shadow'] = "red inset" should not set the property value
+Pass	e.style['box-shadow'] = "inset red" should not set the property value
+Pass	e.style['box-shadow'] = "4px red inset" should not set the property value
+Pass	e.style['box-shadow'] = "red inset 4px" should not set the property value
+Pass	e.style['box-shadow'] = "4px inset red" should not set the property value
+Pass	e.style['box-shadow'] = "inset red 4px" should not set the property value
+Pass	e.style['box-shadow'] = "4px red inset -4px" should not set the property value
+Pass	e.style['box-shadow'] = "4px inset red -4px" should not set the property value
+Pass	e.style['box-shadow'] = "inset 4px red -4px" should not set the property value
+Pass	e.style['box-shadow'] = "4px red 4px inset" should not set the property value
+Pass	e.style['box-shadow'] = "red 4px inset -4px" should not set the property value
+Pass	e.style['box-shadow'] = "4px inset -4px red" should not set the property value
+Pass	e.style['box-shadow'] = "4px -4px red inset 0" should not set the property value
+Pass	e.style['box-shadow'] = "4px -4px inset red 0" should not set the property value
+Pass	e.style['box-shadow'] = "inset 4px -4px red 0" should not set the property value
+Pass	e.style['box-shadow'] = "4px -4px red 0 inset" should not set the property value
+Pass	e.style['box-shadow'] = "red 4px -4px inset 0" should not set the property value
+Pass	e.style['box-shadow'] = "4px -4px inset 0 red" should not set the property value
+Pass	e.style['box-shadow'] = "1px 1px -1px" should not set the property value
\ No newline at end of file
diff --git a/Tests/LibWeb/Text/input/wpt-import/css/css-backgrounds/parsing/box-shadow-invalid.html b/Tests/LibWeb/Text/input/wpt-import/css/css-backgrounds/parsing/box-shadow-invalid.html
new file mode 100644
index 00000000000..c3040184fcd
--- /dev/null
+++ b/Tests/LibWeb/Text/input/wpt-import/css/css-backgrounds/parsing/box-shadow-invalid.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>CSS Backgrounds and Borders Module Level 3: parsing box-shadow with invalid values</title>
+<link rel="author" title="Elika J. Etemad" href="http://fantasai.inkedblade.net/contact"/>
+<link rel="author" title="Eric Willigers" href="mailto:ericwilligers@chromium.org">
+<link rel="help" href="https://drafts.csswg.org/css-backgrounds/#box-shadow">
+<meta name="assert" content="box-shadow supports only the grammar 'none | <shadow>#'.">
+<meta name="assert" content="Lengths must stay adjacent." />
+<meta name="assert" content="<blur-radius> must be non-negative." />
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script src="../../../css/support/parsing-testcommon.js"></script>
+</head>
+<body>
+<script>
+test_invalid_value("box-shadow", "auto");
+test_invalid_value("box-shadow", "1 2");
+test_invalid_value("box-shadow", "1% 2%");
+test_invalid_value("box-shadow", "1px calc(2px + 2%)");
+
+test_invalid_value("box-shadow", "1px");
+
+test_invalid_value("box-shadow", "1px 2px 3px 4px 5px");
+test_invalid_value("box-shadow", "red 1px 2px blue");
+
+
+test_invalid_value("box-shadow", "red");
+test_invalid_value("box-shadow", "4px red");
+test_invalid_value("box-shadow", "red 4px");
+test_invalid_value("box-shadow", "-4px red 4px");
+test_invalid_value("box-shadow", "red -4px 4px red");
+test_invalid_value("box-shadow", "-4px 4px red 0");
+test_invalid_value("box-shadow", "-4px 4px 0 red 0");
+test_invalid_value("box-shadow", "inset");
+test_invalid_value("box-shadow", "inset 4px");
+test_invalid_value("box-shadow", "4px inset");
+test_invalid_value("box-shadow", "4px inset -4px");
+test_invalid_value("box-shadow", "inset 4px -4px inset");
+test_invalid_value("box-shadow", "4px -4px inset 0");
+test_invalid_value("box-shadow", "4px -4px 0 inset 0");
+test_invalid_value("box-shadow", "red inset");
+test_invalid_value("box-shadow", "inset red");
+test_invalid_value("box-shadow", "4px red inset");
+test_invalid_value("box-shadow", "red inset 4px");
+test_invalid_value("box-shadow", "4px inset red");
+test_invalid_value("box-shadow", "inset red 4px");
+test_invalid_value("box-shadow", "4px red inset -4px");
+test_invalid_value("box-shadow", "4px inset red -4px");
+test_invalid_value("box-shadow", "inset 4px red -4px");
+test_invalid_value("box-shadow", "4px red 4px inset");
+test_invalid_value("box-shadow", "red 4px inset -4px");
+test_invalid_value("box-shadow", "4px inset -4px red");
+test_invalid_value("box-shadow", "4px -4px red inset 0");
+test_invalid_value("box-shadow", "4px -4px inset red 0");
+test_invalid_value("box-shadow", "inset 4px -4px red 0");
+test_invalid_value("box-shadow", "4px -4px red 0 inset");
+test_invalid_value("box-shadow", "red 4px -4px inset 0");
+test_invalid_value("box-shadow", "4px -4px inset 0 red");
+
+// <blur-radius> must be non-negative
+test_invalid_value("box-shadow", "1px 1px -1px");
+</script>
+</body>
+</html>