From 49586b1c47d649e5598502227a592630e1c23e66 Mon Sep 17 00:00:00 2001 From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com> Date: Tue, 20 Oct 2026 09:30:01 +0000 Subject: [PATCH] Reject malformed alpha and extra args in Color::parse_css Found while testing crates/color/src/lib.rs:165 (also :173) Co-Authored-By: Claude Haiku 5.5 Co-Authored-By: Claude Sonnet 5.5 --- crates/color/src/lib.rs | 16 ++++++++++++++-- crates/color/src/tests.rs | 10 ++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/crates/color/src/lib.rs b/crates/color/src/lib.rs index 8e9f98d9..fdad0fa7 100644 --- a/crates/color/src/lib.rs +++ b/crates/color/src/lib.rs @@ -162,7 +162,13 @@ impl Color { p.parse::().ok().map(|v| v / 255.0) } }; - let alpha = parts.get(3).and_then(|a| parse_alpha(a)).unwrap_or(1.0); + let alpha = match parts.get(3) { + Some(a) => parse_alpha(a)?, + None => 1.0, + }; + if parts.len() > 4 { + return None; + } return Some(Self::new(num(0)?, num(1)?, num(2)?, alpha)); } if let Some(inner) = t.strip_prefix("hsla(").or_else(|| t.strip_prefix("hsl(")).and_then(|r| r.strip_suffix(')')) { @@ -170,7 +176,13 @@ impl Color { let h = parts.first()?.trim_end_matches("deg").parse::().ok()?; let s = parts.get(1)?.trim_end_matches('%').parse::().ok()? / 100.0; let l = parts.get(2)?.trim_end_matches('%').parse::().ok()? / 100.0; - let alpha = parts.get(3).and_then(|a| parse_alpha(a)).unwrap_or(1.0); + let alpha = match parts.get(3) { + Some(a) => parse_alpha(a)?, + None => 1.0, + }; + if parts.len() > 4 { + return None; + } return Some(Hsl { h, s, l }.to_color().with_alpha(alpha)); } if t == "transparent" { diff --git a/crates/color/src/tests.rs b/crates/color/src/tests.rs index 4cf875bb..2216b6fa 100644 --- a/crates/color/src/tests.rs +++ b/crates/color/src/tests.rs @@ -114,3 +114,13 @@ fn infinite_channels_clamp() { let c = Color::new(f32::INFINITY, f32::NEG_INFINITY, f32::NAN, f32::INFINITY); assert_eq!((c.r, c.g, c.b, c.a), (1.0, 0.0, 0.0, 1.0)); } + +#[test] +fn malformed_alpha_or_extra_args_rejected() { + assert_eq!(Color::parse_css("rgba(0,0,0,abc)"), None); + assert_eq!(Color::parse_css("hsla(0,0%,0%,abc)"), None); + assert_eq!(Color::parse_css("rgb(1,2,3,4,5)"), None); + assert_eq!(Color::parse_css("hsl(0,0%,0%,0.5,1)"), None); + assert_eq!(Color::parse_css("rgb(1,2,3)").unwrap().a, 1.0); + assert_eq!(Color::parse_css("rgba(1,2,3,0.5)").unwrap().a, 0.5); +}