LibWeb: Only allow ASFs in descriptor values if explicitly supported

`@function` descriptors are the only ones that support ASFs, while most
descriptors enforce this through their syntaxes implicitly disallowing
ASFs, this wasn't the case for `@property/initial-value`.

We now explictly disallow ASFs unless they are marked as allowed within
`Descriptors.json`.
This commit is contained in:
Callum Law
2026-03-28 21:02:41 +13:00
committed by Sam Atkins
parent 8b66e7f463
commit 071b000d9f
Notes: github-actions[bot] 2026-03-30 18:58:58 +00:00
8 changed files with 84 additions and 15 deletions

View File

@@ -138,6 +138,7 @@ struct DescriptorMetadata {
UnicodeRangeTokens,
};
Vector<Variant<Keyword, PropertyID, ValueType>> syntax;
bool allow_arbitrary_substitution_functions { false };
};
DescriptorMetadata get_descriptor_metadata(AtRuleID, DescriptorID);
@@ -468,7 +469,11 @@ DescriptorMetadata get_descriptor_metadata(AtRuleID at_rule_id, DescriptorID des
generate_syntax_list(descriptor_generator, syntax);
descriptor_generator.set("allow-arbitrary-substitution-functions"sv, descriptor.get_bool("allow-arbitrary-substitution-functions"sv).value_or(false) ? "true" : "false");
descriptor_generator.append(R"~~~(
metadata.allow_arbitrary_substitution_functions = @allow-arbitrary-substitution-functions@;
return metadata;
}
)~~~");
@@ -484,7 +489,12 @@ DescriptorMetadata get_descriptor_metadata(AtRuleID at_rule_id, DescriptorID des
)~~~");
auto const& syntax = custom_descriptors.get_array("syntax"sv).value();
generate_syntax_list(custom_descriptor_generator, syntax);
custom_descriptor_generator.set("allow-arbitrary-substitution-functions"sv, custom_descriptors.get_bool("allow-arbitrary-substitution-functions"sv).value_or(false) ? "true" : "false");
custom_descriptor_generator.append(R"~~~(
metadata.allow_arbitrary_substitution_functions = @allow-arbitrary-substitution-functions@;
return metadata;
}
)~~~");