Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 733936bdb21a71e1cfc778ad75ba009b735cbef3
https://github.com/WebKit/WebKit/commit/733936bdb21a71e1cfc778ad75ba009b735cbef3
Author: Antti Koivisto <[email protected]>
Date: 2026-07-10 (Fri, 10 Jul 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-security-if-expected.txt
M Source/WebCore/style/IfConditionEvaluator.cpp
M Source/WebCore/style/IfConditionEvaluator.h
M Source/WebCore/style/StyleSubstitutionResolver.cpp
Log Message:
-----------
[css-values-5] Propagate attr()-taint through if() conditions
https://bugs.webkit.org/show_bug.cgi?id=318963
rdar://181815712
Reviewed by Tim Nguyen.
When if(style(--foo):bar) reads an attr() tainted property the taint must
propagate
to the substitution value per CSS Values 5 ยง8.7.2 ("attr()-tainted as a whole
if any
attr()-tainted values were involved in creating that substitution value")
*
LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-security-if-expected.txt:
* Source/WebCore/style/IfConditionEvaluator.cpp:
(WebCore::Style::IfConditionEvaluator::evaluateFeature const):
Set m_referencedAttrTaintedValue during evaluation if needed.
* Source/WebCore/style/IfConditionEvaluator.h:
(WebCore::Style::IfConditionEvaluator::referencedAttrTaintedValue const):
* Source/WebCore/style/StyleSubstitutionResolver.cpp:
(WebCore::Style::SubstitutionResolver::substituteIfFunction):
Propagate the taint.
Canonical link: https://commits.webkit.org/316878@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
