Dileep Maurya
3b309a8b89
Automatic update from web-platform-tests Escape font-feature-settings tag on serialization `CSSFontFeatureValue::CustomCSSText()` wrapped the OpenType feature tag in double quotes without escaping its contents. A feature tag is parsed as a 4-byte string in which each byte may be any value in `0x20-0x7E` per OpenType, including '"' (U+0022) \ (U+005C) and '}' (U+007D). Serialization therefore emitted unbalanced quotes, breaking the CSSOM serialize/re-parse round-trip and allowing CSS injection when an application copies `element.style.cssText` into a <style> rule: a tag such as "}/* could close the surrounding rule and inject author-controlled CSS. Serialize the tag with `SerializeString()`, which escapes '"' and '\', matching `CSSFontVariationValue::CustomCSSText()`. Test: `external/wpt/css/css-fonts/parsing/font-feature-settings-valid.html` Bug: 522781838 Change-Id: I5d7b4f87a0f3ea5262cbfd07eeb5f77120466504 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7954618 Reviewed-by: Kevin Babbitt <kbabbitt@microsoft.com> Commit-Queue: Dileep Maurya <dileepmaurya@microsoft.com> Cr-Commit-Position: refs/heads/main@{#1649252} -- wpt-commits: d0fbe2cb3c87541de883c776cf85ca831805b71d wpt-pr: 60725
34 lines
1.4 KiB
HTML
34 lines
1.4 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>CSS Fonts Module Level 3: parsing font-feature-settings with valid values</title>
|
|
<link rel="help" href="https://www.w3.org/TR/css-fonts-3/#font-feature-settings-prop">
|
|
<meta name="assert" content="font-feature-settings supports the full grammar 'normal | <feature-tag-value> #'.">
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<script src="/css/support/parsing-testcommon.js"></script>
|
|
</head>
|
|
<body>
|
|
<script>
|
|
test_valid_value('font-feature-settings', 'normal');
|
|
|
|
// <feature-tag-value> = <string> [ <integer> | on | off ]?
|
|
test_valid_value('font-feature-settings', '"dlig" 1', '"dlig"');
|
|
test_valid_value('font-feature-settings', '"smcp" on', '"smcp"');
|
|
test_valid_value('font-feature-settings', "'c2sc'", '"c2sc"');
|
|
test_valid_value('font-feature-settings', '"liga" off', '"liga" 0');
|
|
test_valid_value('font-feature-settings', '"tnum", \'hist\'', '"tnum", "hist"');
|
|
|
|
test_valid_value('font-feature-settings', '"PKRN"');
|
|
|
|
// A feature tag may contain any byte in 0x20-0x7E per OpenType; quotes and
|
|
// backslashes must be escaped on serialization.
|
|
test_valid_value('font-feature-settings', '"\\22\\7d\\2f\\2a"', '"\\"}/*"');
|
|
test_valid_value('font-feature-settings', '"\\22\\22\\22\\22"', '"\\"\\"\\"\\""');
|
|
|
|
test_valid_value('font-feature-settings', '"dlig" 1, "smcp" on, "dlig" 0', '"dlig", "smcp", "dlig" 0');
|
|
</script>
|
|
</body>
|
|
</html>
|