LibWeb/CSS: Reject filters with invalid URL references

AtkinsSJ · AtkinsSJ · commit 14112bfa80b2 · 2026-07-17T14:48:51.000+01:00
These should make the filter list invalid, not just skip the URL.
diff --git a/Libraries/LibWeb/Painting/Paintable.cpp b/Libraries/LibWeb/Painting/Paintable.cpp
@@ -860,13 +860,13 @@ ResolvedCSSFilter resolve_css_filter(CSS::Filter const& computed_filter, Paintab
         if (filter_operation->is_url()) {
             auto& url_string = filter_operation->as_url().url().url();
             if (url_string.is_empty() || !url_string.starts_with('#'))
-                continue;
+                return {};
             auto fragment_or_error = url_string.substring_from_byte_offset(1);
             if (fragment_or_error.is_error())
-                continue;
+                return {};
             auto maybe_filter = paintable_box.document().get_element_by_id(Utf16String::from_utf8(fragment_or_error.value()));
             if (!maybe_filter)
-                continue;
+                return {};
             if (auto* filter_element = as_if<SVG::SVGFilterElement>(*maybe_filter)) {
                 // Filter primitive lengths are specified in the filtered element's user coordinate system, but the
                 // resulting filter operates in device pixels. Compute the user-unit-to-device-pixel scale so the
@@ -885,6 +885,8 @@ ResolvedCSSFilter resolve_css_filter(CSS::Filter const& computed_filter, Paintab
                 }
                 if (!bounds.is_empty())
                     result.svg_filter_bounds = bounds;
+            } else {
+                return {};
             }
             continue;
         }
diff --git a/Tests/LibWeb/Ref/expected/css-filter-invalid-url-ref.html b/Tests/LibWeb/Ref/expected/css-filter-invalid-url-ref.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<style>
+    .box {
+        display: inline-block;
+        width: 40px;
+        height: 40px;
+        margin: 20px;
+        background: black;
+    }
+</style>
+<div class="box"></div>
+<div class="box"></div>
+<div class="box"></div>
+<div class="box"></div>
+<div class="box"></div>
diff --git a/Tests/LibWeb/Ref/input/css-filter-invalid-url.html b/Tests/LibWeb/Ref/input/css-filter-invalid-url.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<link rel="match" href="../expected/css-filter-invalid-url-ref.html" />
+<style>
+    #not-a-filter {
+        display: none;
+    }
+    .box {
+        display: inline-block;
+        width: 40px;
+        height: 40px;
+        margin: 20px;
+        background: black;
+    }
+    #empty-url { filter: url("") blur(5px); }
+    #external-url { filter: url("filter.svg#filter") blur(5px); }
+    #empty-fragment { filter: url("#") blur(5px); }
+    #missing-element { filter: url("#missing") blur(5px); }
+    #wrong-element { filter: url("#not-a-filter") blur(5px); }
+</style>
+<div id="not-a-filter"></div>
+<div class="box" id="empty-url"></div>
+<div class="box" id="external-url"></div>
+<div class="box" id="empty-fragment"></div>
+<div class="box" id="missing-element"></div>
+<div class="box" id="wrong-element"></div>
