| Index: third_party/WebKit/Source/core/html/HTMLElement.cpp
|
| diff --git a/third_party/WebKit/Source/core/html/HTMLElement.cpp b/third_party/WebKit/Source/core/html/HTMLElement.cpp
|
| index fd68fa31ba72fa0ed183a71a9b33b27b5f67b11e..90d3c5e13b1abf65938e9ffcfc00f6adf1d924a3 100644
|
| --- a/third_party/WebKit/Source/core/html/HTMLElement.cpp
|
| +++ b/third_party/WebKit/Source/core/html/HTMLElement.cpp
|
| @@ -927,9 +927,14 @@ void HTMLElement::addHTMLColorToStyle(MutableStylePropertySet* style, CSSPropert
|
| if (equalIgnoringCase(colorString, "transparent"))
|
| return;
|
|
|
| + // Only allow 3/6-digit hex color parsing during legacy color processing.
|
| + bool allowCSSColorParsing = !colorString.isEmpty();
|
| + if (allowCSSColorParsing && colorString[0] == '#')
|
| + allowCSSColorParsing = (colorString.length() == 4) || (colorString.length() == 7);
|
| +
|
| // If the string is a named CSS color or a 3/6-digit hex color, use that.
|
| Color parsedColor;
|
| - if (!parsedColor.setFromString(colorString))
|
| + if (!allowCSSColorParsing || !parsedColor.setFromString(colorString))
|
| parsedColor.setRGB(parseColorStringWithCrazyLegacyRules(colorString));
|
|
|
| style->setProperty(propertyID, cssValuePool().createColorValue(parsedColor.rgb()));
|
|
|