Chromium Code Reviews Chromium Code Reviews
Issue 2323633002:
Implement animation tainted custom property values (Closed)
| Index: third_party/WebKit/LayoutTests/animations/custom-property-value-tainting.html |
| diff --git a/third_party/WebKit/LayoutTests/animations/custom-property-value-tainting.html b/third_party/WebKit/LayoutTests/animations/custom-property-value-tainting.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..789fb9f243129f8e0ecc21d61549cb735046e08a |
| --- /dev/null |
| +++ b/third_party/WebKit/LayoutTests/animations/custom-property-value-tainting.html |
| @@ -0,0 +1,70 @@ |
| +<script src="../resources/testharness.js"></script> |
| +<script src="../resources/testharnessreport.js"></script> |
| +<body></body> |
| +<script> |
| +function createTarget() { |
| + return document.body.appendChild(document.createElement('div')); |
| +} |
| + |
| +function setTaintedValue(target, property, value) { |
| + target.animate({[property]: value}, {fill: 'forwards'}); |
| + assert_equals(getComputedStyle(target).getPropertyValue(property), value, |
| + `Tainted value ${value} set on ${property} by animation`); |
| +} |
| + |
| +function testTaintedSubstitution(target, varValue, {animationName, customProperty}) { |
| + target.style.animationName = varValue; |
| + target.style.setProperty('--taint-accepted', varValue); |
| + assert_equals(getComputedStyle(target).animationName, animationName, |
| + `${varValue} with tainted values ommitted`); |
| + assert_equals(getComputedStyle(target).getPropertyValue('--taint-accepted'), customProperty, |
| + `${varValue} with tainted values accepted`); |
| +} |
| + |
| +test(() => { |
| + var target = createTarget(); |
| + setTaintedValue(target, '--tainted', ', tainted'); |
| + testTaintedSubstitution(target, 'untainted var(--tainted)', { |
| + animationName: 'untainted', |
|
Timothy Loh
2016/10/05 07:31:37
These don't look right, shouldn't var(--tainted) b
alancutter (OOO until 2018)
2016/10/06 01:25:32
Done.
|
| + customProperty: 'untainted, tainted', |
| + }); |
| +}, 'Animation tainted values are omitted in CSS property animation-name'); |
| + |
| +test(() => { |
| + var target = createTarget(); |
| + setTaintedValue(target, '--tainted-first', ', tainted'); |
| + target.style.setPropertyValue('--tainted-second', 'var(--tainted-first)'); |
| + testTaintedSubstitution(target, 'untainted var(--tainted-second)', { |
| + animationName: 'untainted', |
| + customProperty: 'untainted, tainted', |
| + }); |
| +}, 'Chained animation tainted values are omitted in CSS property animation-name'); |
| + |
| +test(() => { |
| + var parent = createTarget(); |
| + var child = parent.appendChild(document.createElement('div')); |
| + setTaintedValue(parent, '--tainted', ', , tainted'); |
|
alancutter (OOO until 2018)
2016/10/05 07:46:40
Not sure why there's an extra comma.
alancutter (OOO until 2018)
2016/10/06 01:25:32
Removed commas from test values.
|
| + testTaintedSubstitution(target, 'untainted var(--tainted)', { |
| + animationName: 'untainted', |
| + customProperty: 'untainted, tainted', |
| + }); |
| +}, 'Inherited animation tainted values are omitted in CSS property animation-name'); |
| + |
| +test(() => { |
| + var target = createTarget(); |
| + setTaintedValue(target, '--tainted', ', tainted'); |
| + testTaintedSubstitution(target, 'untainted var(--tainted,, fallback)', { |
| + animationName: 'untainted, fallback', |
| + customProperty: 'untainted, tainted', |
| + }); |
| +}, 'Animation tainted values trigger var fallbacks in CSS property animation-name'); |
| + |
| +test(() => { |
| + var target = createTarget(); |
| + setTaintedValue(target, '--tainted', ', tainted'); |
| + testTaintedSubstitution(target, 'untainted var(--unknown, untainted, var(--tainted))', { |
| + animationName: 'untainted, untainted', |
| + customProperty: 'untainted, untainted, tainted', |
| + }); |
| +}, 'Animation tainted fallback values are omitted in CSS property animation-name'); |
| +</script> |
