anttijk
WebCore contributor
Summary
anttijk works almost entirely in WebCore's style system, with the recent cluster concentrated on new CSS spec surface: `@function`/mixins (css-mixins-1), arbitrary substitution functions `if()` and `attr()` (css-values-5), style query ranges, and custom highlight pseudo-element inheritance. The pattern is feature implementation rather than security work — the one flagged fix is a use-after-free in `Style::TreeResolver` reached through `XMLDocumentParser::startElementNs` — but several of these commits flip previously off-by-default features (`attr()`, `if()`, `@function`) to enabled, and the accompanying work on attr()-taint propagation through `if()` conditions is itself a sanitization boundary. Where to look next: the newly-enabled substitution and `@function` paths, particularly function-body resolution against the calling context's custom properties and container-query re-resolution when the container changes — freshly shipped, recursion-capable style machinery that has had little external fuzzing.
Components
Security Fix History
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-08-07 [Custom Highlight] ::highlight() pseudo-elements should inherit from the parent element's highlight.
- 2026-07-10 [css-values-5] Propagate attr()-taint through if() conditions
- 2026-07-09 [css-values-5] Enable if() arbitrary substitution function by default
- 2026-07-08 [css-mixins-1] Use SelectionMode::PseudoElement for function scoped container queries where needed
- 2026-07-08 [css-values-5] Implement if() arbitrary substitution function
- 2026-07-08 [css-conditional-5] Support style query ranges
- 2026-07-07 [css-values-5 attr()] Enable by default
- 2026-07-07 [css-mixins-1] Enable @function by default
- 2026-07-07 [css-conditional-5] Support style query ranges
- 2026-07-07 [css-mixins-1] Re-resolve functions with @container bodies when the container changes
- 2026-07-06 [css-mixins-1] Evaluate container queries inside @function
- 2026-07-03 [css-mixins-1] Fix minor @function issues
- 2026-07-01 Resolve var() fallback only when the first arg resolves invalid
- 2026-07-01 [css-mixins-1] Unwrap braces in function arguments
- 2026-07-01 [css-mixins-1] Resolve names in @function in the scope where the function was defined