From 9f333c424cb03c624b4a54188efc1931c0ed6e04 Mon Sep 17 00:00:00 2001
From: Sam Atkins <sam@ladybird.org>
Date: Tue, 15 Apr 2025 11:04:04 +0100
Subject: [PATCH] LibWeb/CSS: Ensure a font source format() only contains one
 string/ident

---
 Libraries/LibWeb/CSS/Parser/ValueParsing.cpp           |  6 ++++++
 .../css/css-fonts/parsing/font-face-src-format.txt     | 10 +++++-----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/Libraries/LibWeb/CSS/Parser/ValueParsing.cpp b/Libraries/LibWeb/CSS/Parser/ValueParsing.cpp
index 924305b848d..d8842a75b82 100644
--- a/Libraries/LibWeb/CSS/Parser/ValueParsing.cpp
+++ b/Libraries/LibWeb/CSS/Parser/ValueParsing.cpp
@@ -3711,6 +3711,12 @@ RefPtr<FontSourceStyleValue> Parser::parse_font_source_value(TokenStream<Compone
             return nullptr;
         }
 
+        format_tokens.discard_whitespace();
+        if (format_tokens.has_next_token()) {
+            dbgln_if(CSS_PARSER_DEBUG, "CSSParser: font source invalid (`format()` has trailing tokens); discarding.");
+            return nullptr;
+        }
+
         format = move(format_name);
     }
 
diff --git a/Tests/LibWeb/Text/expected/wpt-import/css/css-fonts/parsing/font-face-src-format.txt b/Tests/LibWeb/Text/expected/wpt-import/css/css-fonts/parsing/font-face-src-format.txt
index 57eed5c7ea0..3ac3c5e766d 100644
--- a/Tests/LibWeb/Text/expected/wpt-import/css/css-fonts/parsing/font-face-src-format.txt
+++ b/Tests/LibWeb/Text/expected/wpt-import/css/css-fonts/parsing/font-face-src-format.txt
@@ -2,8 +2,8 @@ Harness status: OK
 
 Found 35 tests
 
-30 Pass
-5 Fail
+33 Pass
+2 Fail
 Pass	Check that src: url("foo.ttf") is valid
 Pass	Check that src: url("foo.ttf"), url("bar.ttf") is valid
 Pass	Check that src: url("foo.ttf") format() is invalid
@@ -15,14 +15,14 @@ Pass	Check that src: url("foo.ttf") format("opentype") is valid
 Pass	Check that src: url("foo.ttf") format("truetype") is valid
 Pass	Check that src: url("foo.ttf") format("woff") is valid
 Pass	Check that src: url("foo.ttf") format("woff2") is valid
-Fail	Check that src: url("foo.ttf") format("opentype", "truetype") is invalid
+Pass	Check that src: url("foo.ttf") format("opentype", "truetype") is invalid
 Fail	Check that src: url("foo.ttf") format(collection) is valid
 Pass	Check that src: url("foo.ttf") format(opentype) is valid
 Pass	Check that src: url("foo.ttf") format(truetype) is valid
 Pass	Check that src: url("foo.ttf") format(woff) is valid
 Pass	Check that src: url("foo.ttf") format(woff2) is valid
-Fail	Check that src: url("foo.ttf") format(opentype, truetype) is invalid
-Fail	Check that src: url("foo.ttf") format(opentype truetype) is invalid
+Pass	Check that src: url("foo.ttf") format(opentype, truetype) is invalid
+Pass	Check that src: url("foo.ttf") format(opentype truetype) is invalid
 Pass	Check that src: url("foo.ttf") format(auto) is invalid
 Pass	Check that src: url("foo.ttf") format(default) is invalid
 Pass	Check that src: url("foo.ttf") format(inherit) is invalid