Restrict font-family in @font-face to <family-name>

third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/css/parser/CSSPropertyParser.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSCalculationValue.h"
 #include "core/css/CSSFontFaceSrcValue.h"
@@ skipping 326 matching lines @@
         return consumeIdent(range);
     if (token.type() != NumberToken || token.numericValueType() != IntegerValueType)
         return nullptr;
     int weight = static_cast<int>(token.numericValue());
     if ((weight % 100) || weight < 100 || weight > 900)
         return nullptr;
     range.consumeIncludingWhitespace();
     return cssValuePool().createIdentifierValue(static_cast<CSSValueID>(CSSValue100 + weight / 100 - 1));
 }
 
+static String concatenateFamilyName(CSSParserTokenRange& range)
+{
+    StringBuilder builder;
+    bool addedSpace = false;
+    const CSSParserToken& firstToken = range.peek();
+    while (range.peek().type() == IdentToken) {
+        if (!builder.isEmpty()) {
+            builder.append(' ');
+            addedSpace = true;
+        }
+        builder.append(range.consumeIncludingWhitespace().value());
+    }
+    if (!addedSpace && isCSSWideKeyword(firstToken.id()))
+        return String();
+    return builder.toString();
+}
+
+static PassRefPtrWillBeRawPtr<CSSValue> consumeFamilyName(CSSParserTokenRange& range)
+{
+    if (range.peek().type() == StringToken)
+        return cssValuePool().createFontFamilyValue(range.consumeIncludingWhitespace().value());
+    if (range.peek().type() != IdentToken)
+        return nullptr;
+    String familyName = concatenateFamilyName(range);
+    if (familyName.isNull())
+        return nullptr;
+    return cssValuePool().createFontFamilyValue(familyName);
+}
+
+static PassRefPtrWillBeRawPtr<CSSValue> consumeGenericFamily(CSSParserTokenRange& range)
+{
+    if (range.peek().id() >= CSSValueSerif && range.peek().id() <= CSSValueWebkitBody)
+        return consumeIdent(range);
+    return nullptr;
+}
+
+static PassRefPtrWillBeRawPtr<CSSValueList> consumeFontFamily(CSSParserTokenRange& range)
+{
+    RefPtrWillBeRawPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
+    do {
+        RefPtrWillBeRawPtr<CSSValue> parsedValue = nullptr;
+        if ((parsedValue = consumeGenericFamily(range))) {
+            list->append(parsedValue);
+        } else if ((parsedValue = consumeFamilyName(range))) {
+            list->append(parsedValue);
+        } else {
+            return nullptr;
+        }
+    } while (consumeCommaIncludingWhitespace(range));
+    return list.release();
+}
+
 PassRefPtrWillBeRawPtr<CSSValue> CSSPropertyParser::parseSingleValue(CSSPropertyID propId)
 {
     m_range.consumeWhitespace();
     switch (propId) {
     case CSSPropertyWillChange:
         return consumeWillChange(m_range);
     case CSSPropertyPage:
         return consumePage(m_range);
     case CSSPropertyQuotes:
         return consumeQuotes(m_range);
     case CSSPropertyWebkitHighlight:
         return consumeWebkitHighlight(m_range);
     case CSSPropertyFontVariantLigatures:
         return consumeFontVariantLigatures(m_range);
     case CSSPropertyWebkitFontFeatureSettings:
         return consumeFontFeatureSettings(m_range);
     case CSSPropertyFontVariant:
         return consumeFontVariant();
     case CSSPropertyFontFamily:
-        return consumeFontFamily();
+        return consumeFontFamily(m_range);
     case CSSPropertyFontWeight:
         return consumeFontWeight(m_range);
     default:
         return nullptr;
     }
 }
 
 static PassRefPtrWillBeRawPtr<CSSValueList> consumeFontFaceUnicodeRange(CSSParserTokenRange& range)
 {
     RefPtrWillBeRawPtr<CSSValueList> values = CSSValueList::createCommaSeparated();
@@ skipping 28 matching lines @@
     // but CSSFontFaceSrcValue stores only one format. Allowing one format for now.
     // FIXME: IdentToken should not be supported here.
     CSSParserTokenRange args = consumeFunction(m_range);
     const CSSParserToken& arg = args.consumeIncludingWhitespace();
     if ((arg.type() != StringToken && arg.type() != IdentToken) || !args.atEnd())
         return nullptr;
     uriValue->setFormat(arg.value());
     return uriValue.release();
 }
 
-static String concatenateFamilyName(CSSParserTokenRange& range)
-{
-    StringBuilder builder;
-    bool addedSpace = false;
-    const CSSParserToken& firstToken = range.peek();
-    while (range.peek().type() == IdentToken) {
-        if (!builder.isEmpty()) {
-            builder.append(' ');
-            addedSpace = true;
-        }
-        builder.append(range.consumeIncludingWhitespace().value());
-    }
-    if (!addedSpace && isCSSWideKeyword(firstToken.id())) {
-        return String();
-}
-    return builder.toString();
-}
-
 PassRefPtrWillBeRawPtr<CSSValue> CSSPropertyParser::consumeFontFaceSrcLocal()
 {
     CSSParserTokenRange args = consumeFunction(m_range);
     ContentSecurityPolicyDisposition shouldCheckContentSecurityPolicy = m_context.shouldCheckContentSecurityPolicy();
     if (args.peek().type() == StringToken) {
         const CSSParserToken& arg = args.consumeIncludingWhitespace();
         if (!args.atEnd())
             return nullptr;
         return CSSFontFaceSrcValue::createLocal(arg.value(), shouldCheckContentSecurityPolicy);
     }
@@ skipping 17 matching lines @@
             parsedValue = consumeFontFaceSrcLocal();
         else
             parsedValue = consumeFontFaceSrcURI();
         if (!parsedValue)
             return nullptr;
         values->append(parsedValue);
     } while (consumeCommaIncludingWhitespace(m_range));
     return values.release();
 }
 
-static PassRefPtrWillBeRawPtr<CSSValue> consumeFamilyName(CSSParserTokenRange& range)
-{
-    if (range.peek().type() == StringToken)
-        return cssValuePool().createFontFamilyValue(range.consumeIncludingWhitespace().value());
-    if (range.peek().type() != IdentToken)
-        return nullptr;
-    String familyName = concatenateFamilyName(range);
-    if (familyName.isNull())
-        return nullptr;
-    return cssValuePool().createFontFamilyValue(familyName);
-}
-
-static PassRefPtrWillBeRawPtr<CSSValue> consumeGenericFamily(CSSParserTokenRange& range)
-{
-    if (range.peek().id() >= CSSValueSerif && range.peek().id() <= CSSValueWebkitBody)
-        return consumeIdent(range);
-    return nullptr;
-}
-
-PassRefPtrWillBeRawPtr<CSSValueList> CSSPropertyParser::consumeFontFamily()
-{
-    RefPtrWillBeRawPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
-    do {
-        RefPtrWillBeRawPtr<CSSValue> parsedValue = nullptr;
-        if ((parsedValue = consumeGenericFamily(m_range))) {
-            list->append(parsedValue);
-        } else if ((parsedValue = consumeFamilyName(m_range))) {
-            list->append(parsedValue);
-        } else {
-            return nullptr;
-        }
-    } while (consumeCommaIncludingWhitespace(m_range));
-    if (m_ruleType == StyleRule::FontFace && list->length() > 1)
-        return nullptr;
-    return list.release();
-}
-
 bool CSSPropertyParser::parseFontFaceDescriptor(CSSPropertyID propId)
 {
     RefPtrWillBeRawPtr<CSSValue> parsedValue = nullptr;
 
     m_range.consumeWhitespace();
     switch (propId) {
+    case CSSPropertyFontFamily:
+        if (consumeGenericFamily(m_range))
+            return false;
+        parsedValue = consumeFamilyName(m_range);
+        break;
     case CSSPropertySrc: // This is a list of urls or local references.
         parsedValue = consumeFontFaceSrc();
         break;
     case CSSPropertyUnicodeRange:
         parsedValue = consumeFontFaceUnicodeRange(m_range);
         break;
     case CSSPropertyFontStretch:
     case CSSPropertyFontStyle: {
         CSSValueID id = m_range.consumeIncludingWhitespace().id();
         if (!CSSParserFastPaths::isValidKeywordPropertyAndValue(propId, id))
             return false;
         parsedValue = cssValuePool().createIdentifierValue(id);
         break;
     }
-    // TODO(rwlbuis): check there is only one family-name in font-face descriptor case
-    case CSSPropertyFontFamily:
     case CSSPropertyFontVariant:
     case CSSPropertyFontWeight:
     case CSSPropertyWebkitFontFeatureSettings:
         parsedValue = parseSingleValue(propId);
         break;
     default:
         break;
     }
 
     if (!parsedValue || !m_range.atEnd())
@@ skipping 44 matching lines @@
         addProperty(CSSPropertyOverflowX, overflowXValue.release(), important);
         addProperty(CSSPropertyOverflowY, overflowYValue.release(), important);
         return true;
     }
     default:
         return false;
     }
 }
 
 } // namespace blink