diff --git a/Libraries/LibWeb/CSS/Parser/GradientParsing.cpp b/Libraries/LibWeb/CSS/Parser/GradientParsing.cpp index 884973311e4..d44a525a974 100644 --- a/Libraries/LibWeb/CSS/Parser/GradientParsing.cpp +++ b/Libraries/LibWeb/CSS/Parser/GradientParsing.cpp @@ -545,6 +545,14 @@ RefPtr Parser::parse_radial_gradient_function(TokenStr return {}; }; + auto length_percentage_is_non_negative = [](LengthPercentage const& length_percentage) -> bool { + if (length_percentage.is_length() && length_percentage.length().raw_value() < 0) + return false; + if (length_percentage.is_percentage() && length_percentage.percentage().value() < 0) + return false; + return true; + }; + auto parse_size = [&]() -> Optional { // = // | @@ -561,15 +569,18 @@ RefPtr Parser::parse_radial_gradient_function(TokenStr return commit_value(*extent, transaction_size); } auto first_radius = parse_length_percentage(tokens); - if (!first_radius.has_value()) + if (!first_radius.has_value() || !length_percentage_is_non_negative(*first_radius)) return {}; auto transaction_second_dimension = tokens.begin_transaction(); tokens.discard_whitespace(); if (tokens.has_next_token()) { auto second_radius = parse_length_percentage(tokens); - if (second_radius.has_value()) + if (second_radius.has_value()) { + if (!length_percentage_is_non_negative(*second_radius)) + return {}; return commit_value(EllipseSize { first_radius.release_value(), second_radius.release_value() }, transaction_size, transaction_second_dimension); + } } // FIXME: Support calculated lengths if (first_radius->is_length()) diff --git a/Tests/LibWeb/Text/expected/wpt-import/css/css-backgrounds/parsing/background-image-invalid.txt b/Tests/LibWeb/Text/expected/wpt-import/css/css-backgrounds/parsing/background-image-invalid.txt new file mode 100644 index 00000000000..78228be40ed --- /dev/null +++ b/Tests/LibWeb/Text/expected/wpt-import/css/css-backgrounds/parsing/background-image-invalid.txt @@ -0,0 +1,17 @@ +Harness status: OK + +Found 12 tests + +12 Pass +Pass e.style['background-image'] = "none, auto" should not set the property value +Pass e.style['background-image'] = "radial-gradient(circle -10px at center, red, blue)" should not set the property value +Pass e.style['background-image'] = "repeating-radial-gradient(-10px at center, red, blue)" should not set the property value +Pass e.style['background-image'] = "radial-gradient(ellipse -20px 30px at center, red, blue)" should not set the property value +Pass e.style['background-image'] = "repeating-radial-gradient(-20% 30% at center, red, blue)" should not set the property value +Pass e.style['background-image'] = "radial-gradient(20px -30px at center, red, blue)" should not set the property value +Pass e.style['background-image'] = "repeating-radial-gradient(20px -30px ellipse at center, red, blue)" should not set the property value +Pass e.style['background-image'] = "cross-fade(auto blue, 50% red)" should not set the property value +Pass e.style['background-image'] = "cross-fade(1px red, green)" should not set the property value +Pass e.style['background-image'] = "cross-fade(calc(1% + 1px) red, green)" should not set the property value +Pass e.style['background-image'] = "cross-fade(-1% red, green)" should not set the property value +Pass e.style['background-image'] = "cross-fade(101% red, green)" should not set the property value \ No newline at end of file diff --git a/Tests/LibWeb/Text/input/wpt-import/css/css-backgrounds/parsing/background-image-invalid.html b/Tests/LibWeb/Text/input/wpt-import/css/css-backgrounds/parsing/background-image-invalid.html new file mode 100644 index 00000000000..71a07fdb3bf --- /dev/null +++ b/Tests/LibWeb/Text/input/wpt-import/css/css-backgrounds/parsing/background-image-invalid.html @@ -0,0 +1,34 @@ + + + + +CSS Backgrounds and Borders Module Level 3: parsing background-image with invalid values + + + + + + + + + + + + +