[PEPC] Clamp border radius to 25%/50% (width/height) to prevent possible abuse

andypaicu · chromium-wpt-export-bot · commit c4ab993576ca · 2025-08-07T09:09:52.000-07:00
If the border and radius is set up in a clever way, it can cover a significant portion of the permission element's text without this being detected. This CL limits the possible values of border-radius to at most 50% for height and 25% for width. Also fix the `text-indent` property in CSS which should not be inherited to the permission element at all (but currently is). Change-Id: I891fd42b2435aeb2f46af377158bb27518a0b513 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6825964 Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org> Commit-Queue: Andy Paicu <andypaicu@chromium.org> Cr-Commit-Position: refs/heads/main@{#1498247}
diff --git a/html/semantics/permission-element/border-radius-bounds-ref.html b/html/semantics/permission-element/border-radius-bounds-ref.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html>
+  <meta charset="utf-8" />
+  <body>
+    <style>
+      permission {
+        border-radius: 25%/50%;
+      }
+    </style>
+    <permission type="camera"></permission>
+  </body>
+</html>
diff --git a/html/semantics/permission-element/border-radius-bounds.tentative.html b/html/semantics/permission-element/border-radius-bounds.tentative.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html>
+  <meta charset="utf-8" />
+  <link rel="match" href="border-radius-bounds-ref.html" />
+  <link
+    rel="help"
+    href="https://github.com/WICG/PEPC/blob/main/explainer.md#locking-the-pepc-style"
+  />
+  <body>
+    <style>
+      permission {
+        border-radius: 1000px;
+      }
+    </style>
+    <permission type="camera"></permission>
+  </body>
+</html>
