diff options
Diffstat (limited to 'src/3rdparty/webkit/WebCore/css/CSSParser.cpp')
| -rw-r--r-- | src/3rdparty/webkit/WebCore/css/CSSParser.cpp | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp index 36b86a45ba..4a9412e6e6 100644 --- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp +++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp @@ -621,7 +621,6 @@ bool CSSParser::parseValue(int propId, bool important) case CSSPropertyContent: // [ <string> | <uri> | <counter> | attr(X) | open-quote | // close-quote | no-open-quote | no-close-quote ]+ | inherit return parseContent(propId, important); - break; case CSSPropertyWhiteSpace: // normal | pre | nowrap | inherit if (id == CSSValueNormal || @@ -1979,13 +1978,21 @@ bool CSSParser::parseContent(int propId, bool important) if (args->size() != 1) return false; CSSParserValue* a = args->current(); + if (a->unit != CSSPrimitiveValue::CSS_IDENT) + return false; String attrName = a->string; + // CSS allows identifiers with "-" at the start, like "-webkit-mask-image". + // But HTML attribute names can't have those characters, and we should not + // even parse them inside attr(). + if (attrName[0] == '-') + return false; if (document()->isHTMLDocument()) attrName = attrName.lower(); parsedValue = CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR); } else if (equalIgnoringCase(val->function->name, "counter(")) { parsedValue = parseCounterContent(args, false); - if (!parsedValue) return false; + if (!parsedValue) + return false; } else if (equalIgnoringCase(val->function->name, "counters(")) { parsedValue = parseCounterContent(args, true); if (!parsedValue) |