Reject negative blur() values in CSS filter parser

Author: intergalacticspacehighway

packages/react-native/ReactCommon/react/renderer/css/CSSFilter.h

@@ -73,7 +73,13 @@ struct CSSDataTypeParser<CSSBlurFilter> {
     }
 
     auto len = parser.parseNextValue<CSSLength>();
-    return CSSBlurFilter{std::holds_alternative<CSSLength>(len) ? std::get<CSSLength>(len) : CSSLength{}};
+    if (std::holds_alternative<CSSLength>(len)) {
+      if (std::get<CSSLength>(len).value < 0.0f) {
+        return {};
+      }
+      return CSSBlurFilter{std::get<CSSLength>(len)};
+    }
+    return CSSBlurFilter{};
   }
 };
 

packages/react-native/ReactCommon/react/renderer/css/tests/CSSFilterTest.cpp

@@ -32,6 +32,11 @@ TEST(CSSFilter, blur_default) {
   EXPECT_EQ(std::get<CSSBlurFilter>(value).amount.unit, CSSLengthUnit::Px);
 }
 
+TEST(CSSFilter, blur_negative) {
+  auto value = parseCSSProperty<CSSFilterFunction>("blur(-1px)");
+  EXPECT_TRUE(std::holds_alternative<std::monostate>(value));
+}
+
 TEST(CSSFilter, blur_number) {
   auto value = parseCSSProperty<CSSFilterFunction>("blur(10)");
   EXPECT_TRUE(std::holds_alternative<std::monostate>(value));