Merge pull request #911 from Silvertree2010/fix/h737-parse-css-accepts-a-malformed-al

Reject malformed alpha and extra args in Color::parse_css

crates/color/src/lib.rs

@@ -162,7 +162,13 @@ impl Color {
                     p.parse::<f32>().ok().map(|v| v / 255.0)
                 }
             };
-            let alpha = parts.get(3).and_then(|a| parse_alpha(a)).unwrap_or(1.0);
+            let alpha = match parts.get(3) {
+                Some(a) => parse_alpha(a)?,
+                None => 1.0,
+            };
+            if parts.len() > 4 {
+                return None;
+            }
             return Some(Self::new(num(0)?, num(1)?, num(2)?, alpha));
         }
         if let Some(inner) = t.strip_prefix("hsla(").or_else(|| t.strip_prefix("hsl(")).and_then(|r| r.strip_suffix(')')) {
@@ -170,7 +176,13 @@ impl Color {
             let h = parts.first()?.trim_end_matches("deg").parse::<f32>().ok()?;
             let s = parts.get(1)?.trim_end_matches('%').parse::<f32>().ok()? / 100.0;
             let l = parts.get(2)?.trim_end_matches('%').parse::<f32>().ok()? / 100.0;
-            let alpha = parts.get(3).and_then(|a| parse_alpha(a)).unwrap_or(1.0);
+            let alpha = match parts.get(3) {
+                Some(a) => parse_alpha(a)?,
+                None => 1.0,
+            };
+            if parts.len() > 4 {
+                return None;
+            }
             return Some(Hsl { h, s, l }.to_color().with_alpha(alpha));
         }
         if t == "transparent" {

crates/color/src/tests.rs

@@ -114,3 +114,13 @@ fn infinite_channels_clamp() {
     let c = Color::new(f32::INFINITY, f32::NEG_INFINITY, f32::NAN, f32::INFINITY);
     assert_eq!((c.r, c.g, c.b, c.a), (1.0, 0.0, 0.0, 1.0));
 }
+
+#[test]
+fn malformed_alpha_or_extra_args_rejected() {
+    assert_eq!(Color::parse_css("rgba(0,0,0,abc)"), None);
+    assert_eq!(Color::parse_css("hsla(0,0%,0%,abc)"), None);
+    assert_eq!(Color::parse_css("rgb(1,2,3,4,5)"), None);
+    assert_eq!(Color::parse_css("hsl(0,0%,0%,0.5,1)"), None);
+    assert_eq!(Color::parse_css("rgb(1,2,3)").unwrap().a, 1.0);
+    assert_eq!(Color::parse_css("rgba(1,2,3,0.5)").unwrap().a, 0.5);
+}