From dd2d0a6bf72be85207044af77c873963cd1579ea Mon Sep 17 00:00:00 2001
From: Anthony Ramine <n.oxyde@gmail.com>
Date: Wed, 19 Aug 2015 14:45:30 +0200
Subject: [PATCH] Properly detect unexpected font start tags in foreign content

---
 data/test/ignore                   |  2 --
 src/tree_builder/actions.rs        | 17 ++++++++++++++++
 src/tree_builder/rules.expanded.rs | 32 ++++++++++++++----------------
 src/tree_builder/rules.rs          | 23 ++++++++++-----------
 4 files changed, 42 insertions(+), 32 deletions(-)

diff --git a/data/test/ignore b/data/test/ignore
index 51263922..2873874a 100644
--- a/data/test/ignore
+++ b/data/test/ignore
@@ -41,8 +41,6 @@ tb: foreign-fragment.dat-40
 tb: foreign-fragment.dat-41
 tb: foreign-fragment.dat-47
 tb: foreign-fragment.dat-48
-tb: domjs-unsafe.dat-46
-tb: domjs-unsafe.dat-47
 tb: tests20.dat-34
 tb: tests20.dat-35
 tb: tests20.dat-36
diff --git a/src/tree_builder/actions.rs b/src/tree_builder/actions.rs
index 3f8b15c5..34e7c944 100644
--- a/src/tree_builder/actions.rs
+++ b/src/tree_builder/actions.rs
@@ -121,6 +121,7 @@ pub trait TreeBuilderActions<Handle> {
     fn adjust_mathml_attributes(&mut self, tag: &mut Tag);
     fn adjust_foreign_attributes(&mut self, tag: &mut Tag);
     fn foreign_start_tag(&mut self, tag: Tag) -> ProcessResult;
+    fn unexpected_start_tag_in_foreign_content(&mut self, tag: Tag) -> ProcessResult;
 }
 
 #[doc(hidden)]
@@ -1096,4 +1097,20 @@ impl<Handle, Sink> TreeBuilderActions<Handle>
             Done
         }
     }
+
+    fn unexpected_start_tag_in_foreign_content(&mut self, tag: Tag) -> ProcessResult {
+        self.unexpected(&tag);
+        if self.is_fragment() {
+            self.foreign_start_tag(tag)
+        } else {
+            self.pop();
+            while !self.current_node_in(|n| {
+                n.ns == ns!(HTML) || mathml_text_integration_point(n.clone())
+                    || html_integration_point(n)
+            }) {
+                self.pop();
+            }
+            ReprocessForeign(TagToken(tag))
+        }
+    }
 }
diff --git a/src/tree_builder/rules.expanded.rs b/src/tree_builder/rules.expanded.rs
index e45d65e2..7495b88f 100644
--- a/src/tree_builder/rules.expanded.rs
+++ b/src/tree_builder/rules.expanded.rs
@@ -8,7 +8,7 @@
 // except according to those terms.
 
 // This file is generated from rules.rs
-// source SipHash: 7583183069601139727
+// source SipHash: 4083772598771558827
 
 # ! [
 doc =
@@ -2572,22 +2572,20 @@ impl <Handle, Sink> TreeBuilderStep for super::TreeBuilder<Handle, Sink> where
                                             name: atom!(ul), .. }) |
             ::tree_builder::types::TagToken(tag@::tokenizer::Tag {
                                             kind: ::tokenizer::StartTag,
-                                            name: atom!(var), .. }) => {
-                self.unexpected(&tag);
-                if self.is_fragment() {
-                    self.foreign_start_tag(tag)
-                } else {
-                    self.pop();
-                    while !self.current_node_in(|n| {
-                                                n.ns == ns!(HTML) ||
-                                                    mathml_text_integration_point(n.clone())
-                                                    ||
-                                                    html_integration_point(n)
-                                            }) {
-                        self.pop();
-                    }
-                    ReprocessForeign(TagToken(tag))
-                }
+                                            name: atom!(var), .. }) =>
+            self.unexpected_start_tag_in_foreign_content(tag),
+            ::tree_builder::types::TagToken(tag@::tokenizer::Tag {
+                                            kind: ::tokenizer::StartTag,
+                                            name: atom!(font), .. }) => {
+                let unexpected =
+                    tag.attrs.iter().any(|attr| {
+                                         matches!(attr . name , qualname ! (
+                                                  "" , color ) | qualname ! (
+                                                  "" , face ) | qualname ! (
+                                                  "" , size )) });
+                if unexpected {
+                    self.unexpected_start_tag_in_foreign_content(tag)
+                } else { self.foreign_start_tag(tag) }
             }
             last_arm_token => {
                 let enable_wildcards = match last_arm_token { _ => true, };
diff --git a/src/tree_builder/rules.rs b/src/tree_builder/rules.rs
index d96f1fb8..8ed47c86 100644
--- a/src/tree_builder/rules.rs
+++ b/src/tree_builder/rules.rs
@@ -1389,20 +1389,17 @@ impl<Handle, Sink> TreeBuilderStep
                 <dt> <em> <embed> <h1> <h2> <h3> <h4> <h5> <h6> <head> <hr> <i>
                 <img> <li> <listing> <menu> <meta> <nobr> <ol> <p> <pre> <ruby>
                 <s> <small> <span> <strong> <strike> <sub> <sup> <table> <tt>
-                <u> <ul> <var>
-            => {
-                self.unexpected(&tag);
-                if self.is_fragment() {
-                    self.foreign_start_tag(tag)
+                <u> <ul> <var> => self.unexpected_start_tag_in_foreign_content(tag),
+
+            tag @ <font> => {
+                let unexpected = tag.attrs.iter().any(|attr| {
+                    matches!(attr.name,
+                             qualname!("", color) | qualname!("", face) | qualname!("", size))
+                });
+                if unexpected {
+                    self.unexpected_start_tag_in_foreign_content(tag)
                 } else {
-                    self.pop();
-                    while !self.current_node_in(|n| {
-                        n.ns == ns!(HTML) || mathml_text_integration_point(n.clone())
-                            || html_integration_point(n)
-                    }) {
-                        self.pop();
-                    }
-                    ReprocessForeign(TagToken(tag))
+                    self.foreign_start_tag(tag)
                 }
             }