Disallow setting invalid values for registered properties via CSSOM

third_party/WebKit/Source/core/css/PropertySetCSSStyleDeclaration.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 217 matching lines @@
     const String& propertyName) {
   CSSPropertyID propertyID = cssPropertyID(propertyName);
 
   // Custom properties don't have shorthands, so we can ignore them here.
   if (!propertyID || propertyID == CSSPropertyVariable)
     return false;
   return propertySet().isPropertyImplicit(propertyID);
 }
 
 void AbstractPropertySetCSSStyleDeclaration::setProperty(
+    const ExecutionContext* executionContext,
     const String& propertyName,
     const String& value,
     const String& priority,
     ExceptionState& exceptionState) {
   CSSPropertyID propertyID = unresolvedCSSPropertyID(propertyName);
   if (!propertyID)
     return;
 
   bool important = equalIgnoringCase(priority, "important");
   if (!important && !priority.isEmpty())
     return;
 
   setPropertyInternal(propertyID, propertyName, value, important,
-                      exceptionState);
+                      executionContext, exceptionState);
 }
 
 String AbstractPropertySetCSSStyleDeclaration::removeProperty(
     const String& propertyName,
     ExceptionState& exceptionState) {
   CSSPropertyID propertyID = cssPropertyID(propertyName);
   if (!propertyID)
     return String();
 
   StyleAttributeMutationScope mutationScope(this);
@@ skipping 29 matching lines @@
     CSSPropertyID propertyID) {
   return propertySet().getPropertyValue(propertyID);
 }
 
 DISABLE_CFI_PERF
 void AbstractPropertySetCSSStyleDeclaration::setPropertyInternal(
     CSSPropertyID unresolvedProperty,
     const String& customPropertyName,
     const String& value,
     bool important,
+    const ExecutionContext* executionContext,
     ExceptionState&) {
   StyleAttributeMutationScope mutationScope(this);
   willMutate();
 
   bool didChange = false;
   if (unresolvedProperty == CSSPropertyVariable) {
+    AtomicString atomicName(customPropertyName);
+
+    DCHECK(executionContext);
+    const PropertyRegistry* registry =
+        toDocument(executionContext)->propertyRegistry();
+
     bool isAnimationTainted = isKeyframeStyle();
-    didChange =
-        propertySet()
-            .setProperty(AtomicString(customPropertyName), value, important,
-                         contextStyleSheet(), isAnimationTainted)
-            .didChange;
+    didChange = propertySet()
+                    .setProperty(atomicName, registry, value, important,
+                                 contextStyleSheet(), isAnimationTainted)
+                    .didChange;
   } else {
     didChange = propertySet()
                     .setProperty(unresolvedProperty, value, important,
                                  contextStyleSheet())
                     .didChange;
   }
 
   didMutate(didChange ? PropertyChanged : NoChanges);
 
   if (!didChange)
@@ skipping 80 matching lines @@
   return m_parentElement ? &m_parentElement->document().elementSheet()
                          : nullptr;
 }
 
 DEFINE_TRACE(InlineCSSStyleDeclaration) {
   visitor->trace(m_parentElement);
   AbstractPropertySetCSSStyleDeclaration::trace(visitor);
 }
 
 }  // namespace blink