Index: third_party/WebKit/Source/core/html/HTMLElement.cpp |
diff --git a/third_party/WebKit/Source/core/html/HTMLElement.cpp b/third_party/WebKit/Source/core/html/HTMLElement.cpp |
index fd68fa31ba72fa0ed183a71a9b33b27b5f67b11e..90d3c5e13b1abf65938e9ffcfc00f6adf1d924a3 100644 |
--- a/third_party/WebKit/Source/core/html/HTMLElement.cpp |
+++ b/third_party/WebKit/Source/core/html/HTMLElement.cpp |
@@ -927,9 +927,14 @@ void HTMLElement::addHTMLColorToStyle(MutableStylePropertySet* style, CSSPropert |
if (equalIgnoringCase(colorString, "transparent")) |
return; |
+ // Only allow 3/6-digit hex color parsing during legacy color processing. |
+ bool allowCSSColorParsing = !colorString.isEmpty(); |
+ if (allowCSSColorParsing && colorString[0] == '#') |
+ allowCSSColorParsing = (colorString.length() == 4) || (colorString.length() == 7); |
+ |
// If the string is a named CSS color or a 3/6-digit hex color, use that. |
Color parsedColor; |
- if (!parsedColor.setFromString(colorString)) |
+ if (!allowCSSColorParsing || !parsedColor.setFromString(colorString)) |
parsedColor.setRGB(parseColorStringWithCrazyLegacyRules(colorString)); |
style->setProperty(propertyID, cssValuePool().createColorValue(parsedColor.rgb())); |