@font-face src descriptor format allows only identifiers for specifie…

…d formats, others are a parse error

https://bugs.webkit.org/show_bug.cgi?id=247552
rdar://problem/102018015

Reviewed by Sam Weinig.

* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/parsing/font-face-src-format-expected.txt:
Expect more PASS.

* Source/WebCore/css/CSSValueKeywords.in: Added the keywords for all the formats in the specification.

* Source/WebCore/css/parser/CSSPropertyParserWorkerSafe.cpp:
(WebCore::CSSPropertyParserHelpersWorkerSafe::consumeFontFaceSrcURI): Allow only keywords for known formats.

Canonical link: https://commits.webkit.org/256382@main

LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/parsing/font-face-src-format-expected.txt

@@ -15,20 +15,20 @@ PASS Check that src: url("foo.ttf") format(woff) is valid
 PASS Check that src: url("foo.ttf") format(woff2) is valid
 PASS Check that src: url("foo.ttf") format(opentype, truetype) is invalid
 PASS Check that src: url("foo.ttf") format(opentype truetype) is invalid
-FAIL Check that src: url("foo.ttf") format(auto) is invalid assert_equals: expected false but got true
-FAIL Check that src: url("foo.ttf") format(default) is invalid assert_equals: expected false but got true
-FAIL Check that src: url("foo.ttf") format(inherit) is invalid assert_equals: expected false but got true
-FAIL Check that src: url("foo.ttf") format(initial) is invalid assert_equals: expected false but got true
-FAIL Check that src: url("foo.ttf") format(none) is invalid assert_equals: expected false but got true
-FAIL Check that src: url("foo.ttf") format(normal) is invalid assert_equals: expected false but got true
-FAIL Check that src: url("foo.ttf") format(xyzzy) is invalid assert_equals: expected false but got true
+PASS Check that src: url("foo.ttf") format(auto) is invalid
+PASS Check that src: url("foo.ttf") format(default) is invalid
+PASS Check that src: url("foo.ttf") format(inherit) is invalid
+PASS Check that src: url("foo.ttf") format(initial) is invalid
+PASS Check that src: url("foo.ttf") format(none) is invalid
+PASS Check that src: url("foo.ttf") format(normal) is invalid
+PASS Check that src: url("foo.ttf") format(xyzzy) is invalid
 PASS Check that src: url("foo.ttf") format("embedded-opentype"), url("bar.html") is valid
 PASS Check that src: url("foo.ttf") format(embedded-opentype), url("bar.html") is valid
 PASS Check that src: url("foo.ttf") format("svg"), url("bar.html") is valid
 PASS Check that src: url("foo.ttf") format(svg), url("bar.html") is valid
 PASS Check that src: url("foo.ttf") format(xyzz 200px), url("bar.html") is invalid
-FAIL Check that src: url("foo.ttf") format(xyzz), url("bar.html") is invalid assert_equals: expected false but got true
+PASS Check that src: url("foo.ttf") format(xyzz), url("bar.html") is invalid
 PASS Check that src: url("foo.ttf") dummy(xyzzy), url("bar.html") is invalid
 PASS Check that src: url("foo.ttf") format(), url("bar.html") is invalid
-FAIL Check that src: url("foo.ttf") format(none), url("bar.html") is invalid assert_equals: expected false but got true
+PASS Check that src: url("foo.ttf") format(none), url("bar.html") is invalid
 

Source/WebCore/css/CSSValueKeywords.in

@@ -1280,6 +1280,13 @@ polygon
 
 // @font-face src
 format
+collection
+embedded-opentype
+opentype
+svg
+truetype
+woff
+woff2
 
 // (-webkit-)filter
 // invert

Source/WebCore/css/parser/CSSPropertyParserWorkerSafe.cpp

@@ -213,7 +213,12 @@ static RefPtr<CSSFontFaceSrcValue> consumeFontFaceSrcURI(CSSParserTokenRange& ra
         // FIXME: We allow any identifier here and convert all to strings; specification calls for only certain identifiers.
         auto args = CSSPropertyParserHelpers::consumeFunction(range);
         auto& arg = args.consumeIncludingWhitespace();
-        if ((arg.type() != StringToken && arg.type() != IdentToken) || !args.atEnd())
+        if (!args.atEnd())
+            return nullptr;
+        if (arg.type() == IdentToken) {
+            if (!identMatches<CSSValueCollection, CSSValueEmbeddedOpentype, CSSValueOpentype, CSSValueSvg, CSSValueTruetype, CSSValueWoff, CSSValueWoff2>(arg.id()))
+                return nullptr;
+        } else if (arg.type() != StringToken)
             return nullptr;
         format = arg.value().toString();
     }