From d6308c6eed27ea4abc744eea3e6a103a74446969 Mon Sep 17 00:00:00 2001 From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com> Date: Wed, 28 Oct 2026 00:43:35 +0100 Subject: [PATCH] Reject '+' signs in Lottie text stroke colour hex pairs Found while testing crates/lottie/src/import.rs:48-51 (hex_color) Co-Authored-By: Claude Haiku 5.5 Co-Authored-By: Claude Sonnet 5.5 --- crates/lottie/src/import.rs | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/crates/lottie/src/import.rs b/crates/lottie/src/import.rs index b2eeece49..ba0176fd3 100644 --- a/crates/lottie/src/import.rs +++ b/crates/lottie/src/import.rs @@ -47,7 +47,9 @@ fn s<'a>(j: &'a Json, k: &str) -> Option<&'a str> { fn hex_color(sc: &str) -> [f32; 3] { let h = sc.trim_start_matches('#'); - let c = |i: usize| h.get(i..i + 2).and_then(|x| u8::from_str_radix(x, 16).ok()).unwrap_or(0) as f32 / 255.0; + let c = |i: usize| { + h.get(i..i + 2).filter(|x| x.bytes().all(|b| b.is_ascii_hexdigit())).and_then(|x| u8::from_str_radix(x, 16).ok()).unwrap_or(0) as f32 / 255.0 + }; [c(0), c(2), c(4)] } @@ -485,3 +487,15 @@ fn build_layers(cx: &mut Ctx, project: &mut Project, comp: &mut Comp, layers: &[ } } } + +#[cfg(test)] +mod hex_color_tests { + use super::hex_color; + + #[test] + fn hex_color_rejects_plus_sign() { + assert_eq!(hex_color("#+f0000"), [0.0, 0.0, 0.0]); + assert_eq!(hex_color("#zz0000"), [0.0, 0.0, 0.0]); + assert_eq!(hex_color("#ff0000"), [1.0, 0.0, 0.0]); + } +}