Implement stricter hashless hex color parsing

third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSPropertyParserHelpers.h"
 
 #include "core/css/CSSCalculationValue.h"
 #include "core/css/CSSStringValue.h"
 #include "core/css/CSSValuePair.h"
 // TODO(timloh): Remove this dependency
@@ skipping 387 matching lines @@
     }
     result = makeRGBAFromHSLA(colorArray[0], colorArray[1], colorArray[2], alpha);
     return args.atEnd();
 }
 
 static bool parseHexColor(CSSParserTokenRange& range, RGBA32& result, bool acceptQuirkyColors)
 {
     const CSSParserToken& token = range.peek();
     String color;
     if (acceptQuirkyColors) {
-        if (token.type() == NumberToken && token.numericValueType() == IntegerValueType
-            && token.numericValue() >= 0. && token.numericValue() < 1000000.) { // e.g. 112233
+        if (token.type() == NumberToken) { // e.g. 112233
+            if (token.numericValueType() != IntegerValueType
+                || token.numericValue() < 0. || token.numericValue() >= 1000000.)
+                return false;
             color = String::format("%06d", static_cast<int>(token.numericValue()));
         } else if (token.type() == DimensionToken) { // e.g. 0001FF
-            // TODO(timloh): This should check the numericValueType flag
+            if (token.numericValueType() != IntegerValueType || token.numericValue() < 0.)
+                return false;
             color = String::number(static_cast<int>(token.numericValue())) + String(token.value());

[rune, 2016/05/10 21:27:32]

What happens with the static_cast when numericValue() is larger than an int
(could happen since we store the int as a double)? Could the result be something
with less than 6 digits? Perhaps have an upper check as well?

[rwlbuis, 2016/05/10 21:34:31]

Good point! Will have a look.

-            if (color.length() > 6)
-                return false;
             while (color.length() < 6)
                 color = "0" + color;
         } else if (token.type() == IdentToken) { // e.g. FF0000
             color = token.value();
         }
     }
     if (token.type() == HashToken)
         color = token.value();
     if (!Color::parseHexColor(color, result))
         return false;
@@ skipping 164 matching lines @@
     if (!value2) {
         positionFromOneValue(value1, resultX, resultY);
         return true;
     }
     return positionFromTwoValues(value1, value2, resultX, resultY);
 }
 
 } // namespace CSSPropertyParserHelpers
 
 } // namespace blink