Bug 744243 - Forbid odd trailing slash in CSS 'border-image' property. r=dbaron

This commit is contained in:
Kang-Hao (Kenny) Lu 2012-04-12 10:02:33 +02:00
parent a25bd4d8d7
commit c1a7834ef6
2 changed files with 16 additions and 7 deletions

View File

@ -6739,11 +6739,11 @@ CSSParserImpl::ParseBorderImage()
{
nsAutoParseCompoundProperty compound(this);
// border-image: inherit |
// border-image: inherit | -moz-initial |
// <border-image-source> ||
// <border-image-slice>
// [ / <border-image-width>?
// [ / <border-image-outset>]?]? ||
// [ / <border-image-width> |
// / <border-image-width>? / <border-image-outset> ]? ||
// <border-image-repeat>
nsCSSValue value;
@ -6753,7 +6753,7 @@ CSSParserImpl::ParseBorderImage()
AppendValue(eCSSProperty_border_image_width, value);
AppendValue(eCSSProperty_border_image_outset, value);
AppendValue(eCSSProperty_border_image_repeat, value);
// Keyword "inherit" can't be mixed, so we are done.
// Keyword "inherit" (and "-moz-initial") can't be mixed, so we are done.
return true;
}
@ -6792,13 +6792,17 @@ CSSParserImpl::ParseBorderImage()
// [ / <border-image-width>?
if (ExpectSymbol('/', true)) {
ParseBorderImageWidth(false);
bool foundBorderImageWidth = ParseBorderImageWidth(false);
// [ / <border-image-outset>
if (ExpectSymbol('/', true)) {
if (!ParseBorderImageOutset(false)) {
return false;
}
} else if (!foundBorderImageWidth) {
// If this part has an trailing slash, the whole declaration is
// invalid.
return false;
}
}

View File

@ -250,16 +250,21 @@ var gCSSProperties = {
"repeat 27 27 27 27 / 10 10 10 / 10 10 url('border.png')",
"url('border.png') 27 27 27 27 / / 10 10 1em",
"fill 27 27 27 27 / / 10 10 1em url('border.png')",
"url('border.png') 27 27 27 27 /",
"url('border.png') 27 27 27 27 / 1em 1em 1em 1em repeat",
"url('border.png') 27 27 27 27 / 1em 1em 1em 1em stretch round" ],
invalid_values: [ "url('border.png') 27 27 27 27 27",
"url('border.png') 27 27 27 27 / 1em 1em 1em 1em 1em",
"url('border.png') 27 27 27 27 /",
"url('border.png') fill",
"url('border.png') fill repeat",
"fill repeat",
"url('border.png') fill / 1em",
"url('border.png') / repeat" ]
"url('border.png') / repeat",
"url('border.png') 1 /",
"url('border.png') 1 / /",
"1 / url('border.png')",
"url('border.png') / 1",
"url('border.png') / / 1"]
},
"-moz-border-image-source": {
domProp: "MozBorderImageSource",