Check @apply syntax in custom properties declarations at parse time

third_party/WebKit/Source/core/css/parser/CSSVariableParser.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSVariableParser.h"
 
 #include "core/css/CSSCustomPropertyDeclaration.h"
 #include "core/css/parser/CSSParserTokenRange.h"
 #include "core/css/parser/CSSParserValues.h"
 
@@ skipping 30 matching lines @@
             if (!classifyBlock(block, hasReferences, false))
                 return false;
             continue;
         }
 
         ASSERT(range.peek().getBlockType() != CSSParserToken::BlockEnd);
 
         const CSSParserToken& token = range.consume();
         switch (token.type()) {
         case AtKeywordToken: {
-            // This might have false positives if the @apply doesn't actually match
-            // the syntax, but that just means we do extra computation work.
-            if (token.valueEqualsIgnoringASCIICase("apply"))
+            if (token.valueEqualsIgnoringASCIICase("apply")) {
+                range.consumeWhitespace();
+                const CSSParserToken& variableName = range.consumeIncludingWhitespace();
+                if (!CSSVariableParser::isValidVariableName(variableName)
+                    || !(range.atEnd() || range.peek().type() == SemicolonToken || range.peek().type() == RightBraceToken))
+                    return false;
                 hasReferences = true;
+            }
             break;
         }
         case DelimiterToken: {
             if (token.delimiter() == '!' && isTopLevelBlock)
                 return false;
             break;
         }
         case RightParenthesisToken:
         case RightBraceToken:
         case RightBracketToken:
@@ skipping 60 matching lines @@
     CSSValueID type = classifyVariableRange(range, hasReferences);
 
     if (type == CSSValueInvalid)
         return nullptr;
     if (type == CSSValueInternalVariableValue)
         return CSSCustomPropertyDeclaration::create(variableName, CSSVariableData::create(range, hasReferences));
     return CSSCustomPropertyDeclaration::create(variableName, type);
 }
 
 } // namespace blink