Disallow setting invalid values for registered properties via CSSOM

third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSParserImpl.h"
 
 #include "core/css/CSSCustomIdentValue.h"
 #include "core/css/CSSCustomPropertyDeclaration.h"
 #include "core/css/CSSKeyframesRule.h"
 #include "core/css/CSSStyleSheet.h"
+#include "core/css/PropertyRegistry.h"
 #include "core/css/StyleRuleImport.h"
 #include "core/css/StyleRuleKeyframe.h"
 #include "core/css/StyleRuleNamespace.h"
 #include "core/css/StyleSheetContents.h"
 #include "core/css/parser/CSSAtRuleID.h"
 #include "core/css/parser/CSSLazyParsingState.h"
 #include "core/css/parser/CSSLazyPropertyParserImpl.h"
 #include "core/css/parser/CSSParserObserver.h"
 #include "core/css/parser/CSSParserObserverWrapper.h"
 #include "core/css/parser/CSSParserSelector.h"
@@ skipping 40 matching lines @@
   if (!parser.m_parsedProperties.isEmpty()) {
     didParse = true;
     didChange = declaration->addParsedProperties(parser.m_parsedProperties);
   }
   return MutableStylePropertySet::SetResult{didParse, didChange};
 }
 
 MutableStylePropertySet::SetResult CSSParserImpl::parseVariableValue(
     MutableStylePropertySet* declaration,
     const AtomicString& propertyName,
+    const PropertyRegistry* registry,
     const String& value,
     bool important,
     const CSSParserContext& context,
     bool isAnimationTainted) {
   CSSParserImpl parser(context);
   CSSTokenizer tokenizer(value);
   parser.consumeVariableValue(tokenizer.tokenRange(), propertyName, important,
                               isAnimationTainted);
   bool didParse = false;
   bool didChange = false;
   if (!parser.m_parsedProperties.isEmpty()) {
+    if (registry) {
+      const PropertyRegistry::Registration* registration =
+          registry->registration(propertyName);
+      // TODO(timloh): This is a bit wasteful, we parse the registered property
+      // to validate but throw away the result.
+      if (registration &&
+          !registration->syntax().parse(tokenizer.tokenRange(),
+                                        isAnimationTainted)) {
+        return MutableStylePropertySet::SetResult{didParse, didChange};
+      }
+    }
     didParse = true;
     didChange = declaration->addParsedProperties(parser.m_parsedProperties);
   }
   return MutableStylePropertySet::SetResult{didParse, didChange};
 }
 
 static inline void filterProperties(
     bool important,
     const HeapVector<CSSProperty, 256>& input,
     HeapVector<CSSProperty, 256>& output,
@@ skipping 872 matching lines @@
     else
       return nullptr;  // Parser error, invalid value in keyframe selector
     if (range.atEnd())
       return result;
     if (range.consume().type() != CommaToken)
       return nullptr;  // Parser error
   }
 }
 
 }  // namespace blink