<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>39363</bug_id>
          
          <creation_ts>2010-05-19 09:22:56 -0700</creation_ts>
          <short_desc>Fix url tokenization in CSS</short_desc>
          <delta_ts>2022-07-21 17:20:04 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>CSS</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>CONFIGURATION CHANGED</resolution>
          
          
          <bug_file_loc>http://test.csswg.org/source/contributors/mozilla/incoming/reftests/bugs/invalid-url-handling.xht</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Simon Fraser (smfr)">simon.fraser</reporter>
          <assigned_to name="Glenn Adams">glenn</assigned_to>
          <cc>ahmad.saleem792</cc>
    
    <cc>ap</cc>
    
    <cc>benjamin</cc>
    
    <cc>bfulgham</cc>
    
    <cc>glenn</cc>
    
    <cc>rniwa</cc>
    
    <cc>seikwon.kim</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>227852</commentid>
    <comment_count>0</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2010-05-19 09:22:56 -0700</bug_when>
    <thetext>We fail a bunch of the URL tests in this testcase:
http://test.csswg.org/source/contributors/mozilla/incoming/reftests/bugs/invalid-url-handling.xht</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>227854</commentid>
    <comment_count>1</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2010-05-19 09:24:23 -0700</bug_when>
    <thetext>Note that not all of the tests in that file are necessarily valid tests.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>227888</commentid>
    <comment_count>2</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2010-05-19 10:51:52 -0700</bug_when>
    <thetext>See also: bug 28885.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>733906</commentid>
    <comment_count>3</comment_count>
    <who name="Benjamin Poulain">benjamin</who>
    <bug_when>2012-10-03 12:10:31 -0700</bug_when>
    <thetext>I suggest to make a reduction for fast/url, and upload it with failing results.

For info, there is now a working version (albeit incomplete) of WTFRL in the tree.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>733927</commentid>
    <comment_count>4</comment_count>
    <who name="Benjamin Poulain">benjamin</who>
    <bug_when>2012-10-03 12:27:03 -0700</bug_when>
    <thetext>Looking at the failing cases, it does not looks like a URL parsing error. All the invalid URL are considered invalid by KURL.

The tests fail due to the way we handle some invalid input in CSS.

Examples:

Test 3:
  #three { background-color: green; }
  #foo { background: url(foo&quot;bar) }
  #three { background-color: red; }
-&gt;The test expect the last #three to be ignored due to the error on the second line. I don&apos;t see why that test is correct.

Test 4:
  /* not a URI token; the unterminated string ends at end of line */
  #foo { background: url(foo&quot;bar) }
  ) }
  #four { background-color: green; }
 -&gt;The URL is invalid, it is the CSS parsing that is incomplete.

etc.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>734260</commentid>
    <comment_count>5</comment_count>
    <who name="Glenn Adams">glenn</who>
    <bug_when>2012-10-03 17:39:45 -0700</bug_when>
    <thetext>(In reply to comment #4)
&gt; Looking at the failing cases, it does not looks like a URL parsing error. All the invalid URL are considered invalid by KURL.
&gt; 
&gt; The tests fail due to the way we handle some invalid input in CSS.
&gt; 
&gt; Examples:
&gt; 
&gt; Test 3:
&gt;   #three { background-color: green; }
&gt;   #foo { background: url(foo&quot;bar) }
&gt;   #three { background-color: red; }
&gt; -&gt;The test expect the last #three to be ignored due to the error on the second line. I don&apos;t see why that test is correct.

The second line should tokenize as follows (by CSS2.1 lexer rules):

...
BADURL(foo)
BADSTRING(bar ) })

causing the third line to appear as a continuation of the declaration started in the second line, and thus producing a MalformedDeclaration recovery, in which case the background-color: red is ignored

At present, WK doesn&apos;t tokenize in this manner, but instead returns

FUNCTION(url)
IDENT(foo)
&quot;
IDENT(bar)
...

which eventually matches:

function: FUNCTION maybe_space error

since the &quot; token is not a valid operator for combining terms in an expression.

Consequently, WK finishes the declaration on the second line without continuing to third line, and the background-color red is applied.

&gt; 
&gt; Test 4:
&gt;   /* not a URI token; the unterminated string ends at end of line */
&gt;   #foo { background: url(foo&quot;bar) }
&gt;   ) }
&gt;   #four { background-color: green; }
&gt;  -&gt;The URL is invalid, it is the CSS parsing that is incomplete.

The same logic applies as above, but here the &quot;) }&quot; on third line causes the fourth line to be ignored (in WK) as a MalformedStatement. If WK had consumed the string as BADSTRING(bar ) }), then the declaration of second line would complete on the third line&apos;s }, in which case the fourth line would parse.

&gt; 
&gt; etc.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>734265</commentid>
    <comment_count>6</comment_count>
    <who name="Glenn Adams">glenn</who>
    <bug_when>2012-10-03 17:49:47 -0700</bug_when>
    <thetext>(In reply to comment #3)
&gt; I suggest to make a reduction for fast/url, and upload it with failing results.

Working on it now.

&gt; For info, there is now a working version (albeit incomplete) of WTFRL in the tree.

I guess you mean WTFURL, i.e., WTF/wtf/url/api, yes?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>734274</commentid>
    <comment_count>7</comment_count>
    <who name="Benjamin Poulain">benjamin</who>
    <bug_when>2012-10-03 17:56:19 -0700</bug_when>
    <thetext>&gt; (In reply to comment #3)
&gt; &gt; I suggest to make a reduction for fast/url, and upload it with failing results.
&gt; 
&gt; Working on it now.
&gt; 
&gt; &gt; For info, there is now a working version (albeit incomplete) of WTFRL in the tree.
&gt; 
&gt; I guess you mean WTFURL, i.e., WTF/wtf/url/api, yes?

Yep, WTFURL.

After you last comment, I doubt this require tests for URLs. It looks like the CSS tokenizer is the issue here. Isn&apos;t it?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>734279</commentid>
    <comment_count>8</comment_count>
    <who name="Glenn Adams">glenn</who>
    <bug_when>2012-10-03 17:59:01 -0700</bug_when>
    <thetext>(In reply to comment #7)
&gt; &gt; (In reply to comment #3)
&gt; &gt; &gt; I suggest to make a reduction for fast/url, and upload it with failing results.
&gt; &gt; 
&gt; &gt; Working on it now.
&gt; &gt; 
&gt; &gt; &gt; For info, there is now a working version (albeit incomplete) of WTFRL in the tree.
&gt; &gt; 
&gt; &gt; I guess you mean WTFURL, i.e., WTF/wtf/url/api, yes?
&gt; 
&gt; Yep, WTFURL.
&gt; 
&gt; After you last comment, I doubt this require tests for URLs. It looks like the CSS tokenizer is the issue here. Isn&apos;t it?

correct</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1885495</commentid>
    <comment_count>9</comment_count>
    <who name="Ahmad Saleem">ahmad.saleem792</who>
    <bug_when>2022-07-20 17:00:12 -0700</bug_when>
    <thetext>I took a test case from Mozilla Firefox Source Code repo from below link:

https://searchfox.org/mozilla-central/source/layout/reftests/css-parsing/invalid-url-handling.xhtml

and turned it into following JSFiddle:

https://jsfiddle.net/3a9keLtc/show

Based on above JSFiddle, Safari 15.6 on macOS 12.5 passes all test and have green text and it is same across other browsers (Chrome Canary 105 and Firefox Nightly 104) as well.

Is something else needed to be fixed here? Thanks!</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1885883</commentid>
    <comment_count>10</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2022-07-21 17:20:04 -0700</bug_when>
    <thetext>Yeah, I&apos;m sure this got fixed when we copied Blink&apos;s CSS parser.</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>