[Webkit-unassigned] [Bug 239552] New: foo|bar with @namespace foo "*" erroneously treated as *|bar

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=239552

            Bug ID: 239552
           Summary: foo|bar with @namespace foo "*" erroneously treated as
                    *|bar
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Minor
          Priority: P2
         Component: CSS
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: dazabani at igalia.com

Test page: https://bucket.daz.cat/work/igalia/bugs/0.xhtml

The right hand side of a @namespace rule can be any string, with only the empty string having the special meaning of “null namespace or lack of a namespace” [css-namespaces-3]. The rule gives the namespace a nickname that can be used in foo|bar selectors, or when there is no nickname, it restricts the namespace of unqualified type selectors [selectors-4].

*|bar forces the type selector to match any namespace (or none at all), but we treat foo|bar and bar the same way when there is @namespace foo "*" or @namespace "*" respectively. This is unlikely to be a real problem in practice, because XML only allows namespaces with a valid absolute URI, but it’s still incorrect.

The root cause seems to be that SelectorChecker and friends check if QualifiedName::namespaceURI() is starAtom(), which comes from CSSSelectorParser::determineNamespace, which returns starAtom() both when the prefix is star and when the namespace “URI” is star.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220420/a22fd46a/attachment.htm>