LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-11 05:25:32 +03:00
Code Issues Packages Projects Releases Wiki Activity

LibWeb: Cap HTML dimension values at 17895700 (same as Firefox)

Browse Source 
Instead of allowing arbitrarily large values (which could eventually
overflow an i32), let's just cap them at the same limit as Firefox does.

Found by Domato.
This commit is contained in:
Andreas Kling 2024-07-19 16:15:07 +02:00 committed by Andreas Kling
parent 093f1dd805
commit 4e0edd42b9
Notes: github-actions[bot] 2024-07-20 07:31:56 +00:00 
Author: https://github.com/awesomekling
Commit: https://github.com/LadybirdBrowser/ladybird/commit/4e0edd42b95
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/721
3 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Tests/LibWeb/Text/expected/HTML/maxed-out-dimension-value.txt Normal file
View File

@ -0,0 +1 @@
Image height: 17895700

9
Tests/LibWeb/Text/input/HTML/maxed-out-dimension-value.html Normal file
View File

@ -0,0 +1,9 @@
<img height="2147483647">
<script src="../include.js"></script>
<script>
test(() => {
let img = document.querySelector("img");
println("Image height: " + img.offsetHeight);
img.remove();
});
</script>

11
Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp
View File

@ -4691,13 +4691,16 @@ RefPtr<CSS::StyleValue> parse_dimension_value(StringView string)
number_string.append(*position);
++position;
}
auto integer_value = number_string.string_view().to_number<int>();
auto integer_value = number_string.string_view().to_number<double>();
// NOTE: This is apparently the largest value allowed by Firefox.
static float max_dimension_value = 17895700;
float value = min(*integer_value, max_dimension_value);
// 6. If position is past the end of input, then return value as a length.
if (position == input.end())
return CSS::LengthStyleValue::create(CSS::Length::make_px(*integer_value));
float value = *integer_value;
return CSS::LengthStyleValue::create(CSS::Length::make_px(CSSPixels(value)));
// 7. If the code point at position within input is U+002E (.), then:
if (*position == '.') {