Skip to content

Commit

Permalink
Prevent exponential blowup of custom properties.
Browse files Browse the repository at this point in the history
Put a hard cap on the value length instead of counting substitutions, because it
works best, see the comment.

Differential Revision: https://phabricator.services.mozilla.com/D13352

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1510862
gecko-commit: e593d06bcd929ab543824921434def8c6e4c6c5b
gecko-integration-branch: central
gecko-reviewers: jwatt
  • Loading branch information
emilio authored and moz-wptsync-bot committed Nov 29, 2018
1 parent d67fec6 commit 00942a1
Showing 1 changed file with 28 additions and 0 deletions.
28 changes: 28 additions & 0 deletions css/css-variables/variable-exponential-blowup.html
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
<!doctype html>
<title>CSS Variables Test: Exponential blowup doesn't crash</title>
<meta charset="UTF-8">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<link rel="author" href="mailto:[email protected]" title="Emilio Cobos Álvarez">
<link rel="author" href="https://mozilla.org" title="Mozilla">
<link rel="help" href="https://drafts.csswg.org/css-variables/">
<script>
let css = `
--v0: "Something really really really long";
`;
for (let i = 0; i < 30; ++i)
css += `--v${i + 1}: var(--v${i}), var(--v${i});`;
let s = document.createElement("style");
s.innerHTML = `
:root { ${css}; }
:root::before { content: var(--v31); }
`;
document.head.appendChild(s);
</script>
PASS if doesn't crash
<script>
test(function() {
getComputedStyle(document.documentElement, "::before").content;
assert_true(true, "Didn't crash");
});
</script>

0 comments on commit 00942a1

Please sign in to comment.