Make media query feature values more strict

Source/core/css/parser/MediaQueryParser.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/css/parser/MediaQueryParser.h"
 
 #include "core/MediaTypeNames.h"
 #include "core/css/parser/CSSPropertyParser.h"
 #include "core/css/parser/CSSTokenizer.h"
@@ skipping 121 matching lines @@
     else if (type == RightParenthesisToken || type == EOFToken)
         readFeatureEnd(type, token);
     else
         m_state = SkipUntilBlockEnd;
 }
 
 void MediaQueryParser::readFeatureValue(CSSParserTokenType type, const CSSParserToken& token)
 {
     if (type == DimensionToken && token.unitType() == CSSPrimitiveValue::CSS_UNKNOWN) {
         m_state = SkipUntilComma;
-    } else {
-        m_mediaQueryData.addParserValue(type, token);
+    } else if (m_mediaQueryData.tryAddParserValue(type, token)) {
         m_state = ReadFeatureEnd;

[Timothy Loh, 2015/01/07 23:05:27]

I'm not sure this works; doesn't this mean that if we have (say) an at-keyword
token here, we'd just skip over it and not do any state transition? So
(orientation: @junk portrait) would be accepted?

     }
 }
 
 void MediaQueryParser::readFeatureEnd(CSSParserTokenType type, const CSSParserToken& token)
 {
     if (type == RightParenthesisToken || type == EOFToken) {
         if (m_mediaQueryData.addExpression())
             m_state = ReadAnd;
         else
             m_state = SkipUntilComma;
     } else if (type == DelimiterToken && token.delimiter() == '/') {
-        m_mediaQueryData.addParserValue(type, token);
+        m_mediaQueryData.tryAddParserValue(type, token);
         m_state = ReadFeatureValue;
     } else {
         m_state = SkipUntilBlockEnd;
     }
 }
 
 void MediaQueryParser::skipUntilComma(CSSParserTokenType type, const CSSParserToken& token)
 {
     if ((type == CommaToken && !m_blockWatcher.blockLevel()) || type == EOFToken) {
         m_state = ReadRestrictor;
@@ skipping 74 matching lines @@
 
 bool MediaQueryData::addExpression()
 {
     OwnPtrWillBeRawPtr<MediaQueryExp> expression = MediaQueryExp::createIfValid(m_mediaFeature, &m_valueList);
     bool isValid = !!expression;
     m_expressions->append(expression.release());
     m_valueList.destroyAndClear();
     return isValid;
 }
 
-void MediaQueryData::addParserValue(CSSParserTokenType type, const CSSParserToken& token)
+bool MediaQueryData::tryAddParserValue(CSSParserTokenType type, const CSSParserToken& token)
 {
     CSSParserValue value;
     if (type == NumberToken || type == PercentageToken || type == DimensionToken) {
         value.setFromNumber(token.numericValue(), token.unitType());
         value.isInt = (token.numericValueType() == IntegerValueType);
     } else if (type == DelimiterToken) {
         value.unit = CSSParserValue::Operator;
         value.iValue = token.delimiter();
         value.id = CSSValueInvalid;
         value.isInt = false;
-    } else {
+    } else if (type == IdentToken) {
         CSSParserString tokenValue;
         tokenValue.init(token.value());
         value.unit = CSSPrimitiveValue::CSS_IDENT;
         value.string = tokenValue;
         value.id = cssValueKeywordID(tokenValue);
         value.isInt = false;
+    } else {
+        return false;
     }
     m_valueList.addValue(value);
+    return true;
 }
 
 void MediaQueryData::setMediaType(const String& mediaType)
 {
     m_mediaType = mediaType;
     m_mediaTypeSet = true;
 }
 
 } // namespace blink