Follow-up to 3788c12: flag properties that depend on custom propertie…

…s, make the attr() privacy protection less restrictive
css4j · Oct 10, 2024 · e7ebd36 · e7ebd36
1 parent 3593265
commit e7ebd36
Show file tree

Hide file tree

Showing 14 changed files with 216 additions and 90 deletions.
diff --git a/echosvg-css/src/main/java/io/sf/carte/echosvg/css/engine/CSSEngine.java b/echosvg-css/src/main/java/io/sf/carte/echosvg/css/engine/CSSEngine.java
@@ -1210,6 +1210,8 @@ private LexicalUnit replaceLexicalProxy(StyleMap sm, LexicalUnit lexval, CSSStyl
 		LexicalUnit lu = lexval;
 		do {
 			if (lu.getLexicalUnitType() == LexicalType.VAR) {
+				sm.putCustomPtyRelative(propIdx, true);
+
 				LexicalUnit newlu;
 				LexicalUnit param = lu.getParameters();
 				String propertyName = param.getStringValue(); // Property name
@@ -1266,19 +1268,8 @@ private LexicalUnit replaceLexicalProxy(StyleMap sm, LexicalUnit lexval, CSSStyl
 				}
 				continue;
 			} else if (lu.getLexicalUnitType() == LexicalType.ATTR) {
-				if (valueManagers[propIdx].allowsURL()) {
-					return null;
-				}
 				boolean isLexval = lu == lexval;
 				LexicalUnit newlu = replacementAttrUnit(sm, lu, elt, parent, counter, ptySet, propIdx);
-				try {
-					counter.replaceCounter += lu.countReplaceBy(newlu);
-				} catch (CSSBudgetException e) {
-					throw createAttrResourceLimitException(e);
-				}
-				if (counter.replaceCounter >= REPLACE_COUNT_LIMIT) {
-					throw createAttrResourceLimitException();
-				}
 
 				if (newlu == null) {
 					// The current lexical unit can be removed
@@ -1290,6 +1281,17 @@ private LexicalUnit replaceLexicalProxy(StyleMap sm, LexicalUnit lexval, CSSStyl
 					continue;
 				}
 
+				sm.putAttrTainted(propIdx, true);
+
+				try {
+					counter.replaceCounter += lu.countReplaceBy(newlu);
+				} catch (CSSBudgetException e) {
+					throw createAttrResourceLimitException(e);
+				}
+				if (counter.replaceCounter >= REPLACE_COUNT_LIMIT) {
+					throw createAttrResourceLimitException();
+				}
+
 				if (newlu.getLexicalUnitType() != LexicalType.EMPTY) {
 					// We do not want to mess with a declared value, so clone it
 					newlu = newlu.clone();
@@ -1611,7 +1613,7 @@ private LexicalUnit replacementAttrUnit(StyleMap sm, LexicalUnit attr, CSSStylab
 		}
 
 		// Return fallback
-		return lu == null ? null : replaceLexicalProxy(sm, lu, elt, parent, counter, ptySet, propIdx);
+		return lu == null ? null : replaceLexicalProxy(sm, lu.clone(), elt, parent, counter, ptySet, propIdx);
 	}
 
 	private static boolean unitMatchesAttrType(LexicalUnit lunit, String attrtype) {
@@ -3070,13 +3072,15 @@ protected void inlineStyleAttributeUpdated(CSSStylableElement elt, StyleMap styl
 				boolean lh = (lineHeightIndex == -1) ? false : updated[lineHeightIndex];
 				boolean cl = (colorIndex == -1) ? false : updated[colorIndex];
 				boolean isRoot = elt.getOwnerDocument().getDocumentElement() == elt;
+				boolean cp = styleDeclarationUpdateHandler.updatedCustomProperties;
 
 				for (int i = getNumberOfProperties() - 1; i >= 0; --i) {
 					if (updated[i]) {
 						count++;
 					} else if ((fs && style.isFontSizeRelative(i)) || (lh && style.isLineHeightRelative(i))
 							|| (cl && style.isColorRelative(i)) || (fs && isRoot && style.isRootFontSizeRelative(i))
-							|| (lh && isRoot && style.isRootLineHeightRelative(i))) {
+							|| (lh && isRoot && style.isRootLineHeightRelative(i))
+							|| (cp && style.isCustomPtyRelative(i))) {
 						updated[i] = true;
 						clearComputedValue(style, i);
 						count++;
@@ -3218,13 +3222,15 @@ protected void propagateChanges(Node node, int[] props, boolean recascade) {
 			boolean lh = (lineHeightIndex == -1) ? false : updated[lineHeightIndex];
 			boolean cl = (colorIndex == -1) ? false : updated[colorIndex];
 			boolean isRootFs = fs && elt.getOwnerDocument().getDocumentElement() == elt;
+			boolean cp = styleDeclarationUpdateHandler.updatedCustomProperties;
 
 			int count = 0;
 			for (int i = getNumberOfProperties() - 1; i >= 0; --i) {
 				if (updated[i]) {
 					count++;
 				} else if ((fs && style.isFontSizeRelative(i)) || (lh && style.isLineHeightRelative(i))
-						|| (cl && style.isColorRelative(i)) || (isRootFs && style.isRootFontSizeRelative(i))) {
+						|| (cl && style.isColorRelative(i)) || (isRootFs && style.isRootFontSizeRelative(i))
+						|| (cp && style.isCustomPtyRelative(i))) {
 					updated[i] = true;
 					clearComputedValue(style, i);
 					count++;
@@ -3288,6 +3294,7 @@ protected class StyleDeclarationUpdateHandler extends DocumentAdapter implements
 
 		public StyleMap styleMap;
 		public boolean[] updatedProperties = new boolean[getNumberOfProperties()];
+		public boolean updatedCustomProperties;
 
 		/**
 		 * <b>SAC</b>: Implements
@@ -3319,6 +3326,11 @@ public void property(String name, LexicalUnit value, boolean important) {
 			}
 		}
 
+		@Override
+		public void lexicalProperty(String name, LexicalUnit value, boolean important) {
+			updatedCustomProperties = true;
+		}
+
 		@Override
 		public void pendingValue(String name, PendingValue v, boolean important) {
 			int i = getPropertyIndex(name);