Bug (CVE-2019-8615) – Remove support for -apple-trailing-word

• Component: New Bugs
• Status: RESOLVED FIXED

[Myles C. Maxfield]

Remove support for -apple-trailing-word

[Myles C. Maxfield]

Created attachment 366573 [details]
Patch

[alan]

Comment on attachment 366573 [details]
Patch

Yay, InlineIteratorHistory tricked me a few times in the past.

[WebKit Commit Bot]

Comment on attachment 366573 [details]
Patch

Clearing flags on attachment: 366573

Committed r243819: <https://trac.webkit.org/changeset/243819>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/49569237>

[Ryosuke Niwa]

This seems to break Safari detection in https://github.com/cssinjs/css-vendor/blob/41ccf9503d283ee63dd5432595f8902b34f5c2a8/src/prefix.js

[Ryosuke Niwa]

Another example of CSS which uses this CSS property to workaround a bug in Safari:
https://github.com/StackExchange/Stacks/blob/d3a876faf07a13666e6b83220c94ae6a68a58c16/lib/css/components/_stacks-spinner.less

[Myles C. Maxfield]

I wonder if I can make pull requests to those repositories, or at least open issues.

[Myles C. Maxfield]

By the way, things like this are exactly why we should never have exposed this property to the Web in the first place.

[Simon Fraser (smfr)]

I already opened issues.

[Simon Fraser (smfr)]

Comment on attachment 366573 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=366573&action=review

> Source/WebCore/css/CSSProperties.json:-6968
> -        "-apple-trailing-word": {
> -            "inherited": true,
> -            "values": [
> -                "auto",
> -                "-webkit-partially-balanced"
> -            ],
> -            "codegen-properties": {
> -                "name-for-methods": "TrailingWord",
> -                "enable-if": "ENABLE_CSS_TRAILING_WORD"
> -            },
> -            "status": "non-standard"
> -        },

This should have left the property, but marked it "removed" with code-gen disabled.