Blitz - WPT: attr-security-if.html

wpt / css / css-values / attr-security-if.html

Data from commit:
a50cb89 wpt: run reference-named files which are themselves tests (#836) (2026-09-03)

Subtest	Status	Message
'--x: image-set(if(style(--true): attr(data-foo);))' with data-foo="https://does-not-exist.test/404.png"	FAIL	assert_equals: expected "image-set(\"https://does-not-exist.test/404.png\")" but got "image-set(if(style(--true): attr(data-foo);))"
'background-image: image-set(if(style(--true): attr(data-foo);))' with data-foo="https://does-not-exist.test/404.png"	PASS
'background-image: image-set( if(style(--true): url(https://does-not-exist-2.test/404.png); else: attr(data-foo);))' with data-foo="https://does-not-exist-2.test/404.png"	PASS
'background-image: image-set( if(style(--some-string): url(https://does-not-exist.test/404.png);))' with data-foo="https://does-not-exist.test/404.png"	PASS
'background-image: image-set( if(style(--condition-val: attr(data-foo type(*))): url(https://does-not-exist.test/404.png);))' with data-foo="3"	PASS
'background-image: image-set( if(style(--condition-val: attr(data-foo type(*))): url(https://does-not-exist.test/404.png); style(--true): url(https://does-not-exist.test/404.png); else: url(https://does-not-exist.test/404.png);))' with data-foo="1"	PASS
'background-image: image-set(if(style(--true): url(https://does-not-exist.test/404.png); style(--condition-val): url(https://does-not-exist.test/404.png); else: url(https://does-not-exist.test/404.png);))' with data-foo="attr(data-foo type(*))"	PASS
'background-image: image-set( if(style(--condition-val: if(style(--true): attr(data-foo type(*));)): url(https://does-not-exist.test/404.png);))' with data-foo="3"	PASS
'--x: image-set(if(style(--condition-val: if(style(--true): attr(data-foo type(*));)): url(https://does-not-exist.test/404.png);))' with data-foo="3"	FAIL	assert_equals: expected "image-set(url(https://does-not-exist.test/404.png))" but got "image-set(if(style(--condition-val: if(style(--true): attr(data-foo type(*));)): url(https://does-not-exist.test/404.png);))"
'--x: image-set(if(style(--condition-val >= attr(data-foo type(*))): url(https://does-not-exist.test/404.png);))' with data-foo="3"	FAIL	assert_equals: expected "image-set(url(https://does-not-exist.test/404.png))" but got "image-set(if(style(--condition-val >= attr(data-foo type(*))): url(https://does-not-exist.test/404.png);))"
'background-image: image-set( if(style(--condition-val >= attr(data-foo type(*))): url(https://does-not-exist.test/404.png);))' with data-foo="3"	PASS
'background-image: image-set( if(style(--condition-val < attr(data-foo type(*))): url(https://does-not-exist.test/404.png);))' with data-foo="3"	PASS
'background-image: image-set( if(style(--str < attr(data-foo type(*))): url(https://does-not-exist.test/404.png);))' with data-foo="3"	PASS
'background-image: image-set( if(style(--condition-val < attr(data-foo type(*))): url(https://does-not-exist.test/404.png);))' with data-foo="text"	PASS

Enable JavaScript in test iframe

/css/css-values/attr-security-if.html

<!-- Adapted from attr-security.html -->
<!DOCTYPE html>
<title>CSS Values and Units Test: attr() security limitations using if()</title>
<link rel="help" href="https://drafts.csswg.org/css-values-5/#attr-security">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>

<style>
  @property --some-string {
    syntax: "<string>";
    inherits: false;
    initial-value: "empty";
  }
  div {
    --condition-val: 3;
    --str: text;
    --true: true;
    --some-string: attr(data-foo);
  }
</style>

<html>
  <body>
    <div id="attr"></div>
  </body>
</html>

<script>
    function test_attr(property, attrString, attrValue, expectedValue) {
        var elem = document.getElementById("attr");
        elem.setAttribute("data-foo", attrValue);

        elem.style.setProperty("--unregistered", attrString);
        let value = window.getComputedStyle(elem).getPropertyValue("--unregistered");

        test(() => {
          // Skip tests that include unsupported functions, since they are not violation of attr() security.
          if (value == "" || CSS.supports(`${property} : ${value}`)) {
            elem.style.setProperty(property, attrString);
            assert_equals(window.getComputedStyle(elem).getPropertyValue(property),
                          expectedValue);
          }
        }, `'${property}: ${attrString}' with data-foo="${attrValue}"`);

        elem.style.setProperty(property, null);
    }

    const url = "https://does-not-exist.test/404.png";
    const url2 = "https://does-not-exist-2.test/404.png";

    // Test attr-tainting carries through if() function.
    test_attr('--x',
              `image-set(if(style(--true): attr(data-foo);))`,
              url,
              `image-set("${url}")`);
    test_attr('background-image',
              'image-set(if(style(--true): attr(data-foo);))',
              url,
              'none');
    test_attr('background-image',
              `image-set(
                if(style(--true): url(${url2});
                   else: attr(data-foo);))`,
              url2,
              `image-set(url("${url2}") 1dppx)`);
    test_attr('background-image',
              `image-set(
                if(style(--some-string): url(${url});))`,
              url,
              'none');
    test_attr('background-image',
              `image-set(
                if(style(--condition-val: attr(data-foo type(*))): url(${url});))`,
              '3',
              'none');
    test_attr('background-image',
              `image-set(
                if(style(--condition-val: attr(data-foo type(*))): url(${url});
                   style(--true): url(${url});
                   else: url(${url});))`,
              '1',
              'none');
    test_attr('background-image',
              `image-set(if(style(--true): url(${url});
                            style(--condition-val): url(${url});
                            else: url(${url});))`,
              'attr(data-foo type(*))',
              `image-set(url("${url}") 1dppx)`);
    test_attr('background-image',
              `image-set(
                if(style(--condition-val: if(style(--true): attr(data-foo type(*));)): url(${url});))`,
              '3',
              'none');
    test_attr('--x',
              `image-set(if(style(--condition-val: if(style(--true): attr(data-foo type(*));)): url(${url});))`,
              '3',
              `image-set(url(${url}))`);
    test_attr('--x',
              `image-set(if(style(--condition-val >= attr(data-foo type(*))): url(${url});))`,
              '3',
              `image-set(url(${url}))`);
    test_attr('background-image',
              `image-set(
                if(style(--condition-val >= attr(data-foo type(*))): url(${url});))`,
              '3',
              'none');
    test_attr('background-image',
              `image-set(
                if(style(--condition-val < attr(data-foo type(*))): url(${url});))`,
              '3',
              'none');
    test_attr('background-image',
              `image-set(
                if(style(--str < attr(data-foo type(*))): url(${url});))`,
              '3',
              'none');
    test_attr('background-image',
              `image-set(
                if(style(--condition-val < attr(data-foo type(*))): url(${url});))`,
              'text',
              'none');
</script>