Selectors with unknown namespace prefixes should be dropped.

Source/core/css/parser/CSSSelectorParser.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/css/parser/CSSSelectorParser.h"
 
 #include "core/css/CSSSelectorList.h"
 #include "core/css/StyleSheetContents.h"
 #include "core/frame/UseCounter.h"
@@ skipping 139 matching lines @@
     if (m_context.isHTMLDocument())
         elementName = elementName.lower();
 
     while (OwnPtr<CSSParserSelector> simpleSelector = consumeSimpleSelector(range)) {
         if (compoundSelector)
             compoundSelector = addSimpleSelectorToCompound(compoundSelector.release(), simpleSelector.release());
         else
             compoundSelector = simpleSelector.release();
     }
 
-    if (!compoundSelector)
-        return CSSParserSelector::create(determineNameInNamespace(namespacePrefix, elementName));
+    if (!compoundSelector) {
+        AtomicString namespaceURI = determineNamespace(namespacePrefix);
+        if (namespaceURI.isNull())
+            return nullptr;
+        return CSSParserSelector::create(QualifiedName(namespacePrefix, elementName, namespaceURI));
+    }
     prependTypeSelectorIfNeeded(namespacePrefix, elementName, compoundSelector.get());
     return compoundSelector.release();
 }
 
 PassOwnPtr<CSSParserSelector> CSSSelectorParser::consumeSimpleSelector(CSSParserTokenRange& range)
 {
     const CSSParserToken& token = range.peek();
     OwnPtr<CSSParserSelector> selector;
     if (token.type() == HashToken)
         selector = consumeId(range);
@@ skipping 88 matching lines @@
 
     AtomicString namespacePrefix;
     AtomicString attributeName;
     if (!consumeName(block, attributeName, namespacePrefix))
         return nullptr;
     block.consumeWhitespace();
 
     if (m_context.isHTMLDocument())
         attributeName = attributeName.lower();
 
+    AtomicString namespaceURI = determineNamespace(namespacePrefix);
+    if (namespaceURI.isNull())
+        return nullptr;
+
     QualifiedName qualifiedName = namespacePrefix.isNull()
         ? QualifiedName(nullAtom, attributeName, nullAtom)
-        : determineNameInNamespace(namespacePrefix, attributeName);
+        : QualifiedName(namespacePrefix, attributeName, namespaceURI);
 
     OwnPtr<CSSParserSelector> selector = CSSParserSelector::create();
 
     if (block.atEnd()) {
         selector->setAttribute(qualifiedName, CSSSelector::CaseSensitive);
         selector->setMatch(CSSSelector::AttributeSet);
         return selector.release();
     }
 
     selector->setMatch(consumeAttributeMatch(block));
@@ skipping 246 matching lines @@
     return true;
 }
 
 const AtomicString& CSSSelectorParser::defaultNamespace() const
 {
     if (!m_styleSheet)
         return starAtom;
     return m_styleSheet->defaultNamespace();
 }
 
-QualifiedName CSSSelectorParser::determineNameInNamespace(const AtomicString& prefix, const AtomicString& localName)
+const AtomicString& CSSSelectorParser::determineNamespace(const AtomicString& prefix)
 {
     if (!m_styleSheet)
-        return QualifiedName(prefix, localName, defaultNamespace());
-    return QualifiedName(prefix, localName, m_styleSheet->determineNamespace(prefix));
+        return defaultNamespace();
+    return m_styleSheet->determineNamespace(prefix);
 }
 
 void CSSSelectorParser::prependTypeSelectorIfNeeded(const AtomicString& namespacePrefix, const AtomicString& elementName, CSSParserSelector* compoundSelector)
 {
     if (elementName.isNull() && defaultNamespace() == starAtom && !compoundSelector->crossesTreeScopes())
         return;
 
     AtomicString determinedElementName = elementName.isNull() ? starAtom : elementName;
-    QualifiedName tag = determineNameInNamespace(namespacePrefix, determinedElementName);
+    AtomicString namespaceURI = determineNamespace(namespacePrefix);
+    if (namespaceURI.isNull())
+        return;
+    QualifiedName tag = QualifiedName(namespacePrefix, determinedElementName, namespaceURI);
 
     if (compoundSelector->crossesTreeScopes())
         return rewriteSpecifiersWithElementNameForCustomPseudoElement(tag, compoundSelector, elementName.isNull());
 
     if (compoundSelector->pseudoType() == CSSSelector::PseudoContent)
         return rewriteSpecifiersWithElementNameForContentPseudoElement(tag, compoundSelector, elementName.isNull());
 
     // *:host never matches, so we can't discard the * otherwise we can't tell the
     // difference between *:host and just :host.
     if (tag == anyQName() && !compoundSelector->hasHostPseudoSelector())
@@ skipping 90 matching lines @@
         compoundSelector->insertTagHistory(CSSSelector::SubSelector, simpleSelector, relation);
         return compoundSelector;
     }
 
     // All other simple selectors are added to the end of the compound.
     compoundSelector->appendTagHistory(CSSSelector::SubSelector, simpleSelector);
     return compoundSelector;
 }
 
 } // namespace blink