|
| 1 | +From fdf20550de48f3ed89d37ca47e5836eef14c5792 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Roland Shoemaker <roland@golang.org> |
| 3 | +Date: Mon, 29 Sep 2025 16:33:18 -0700 |
| 4 | +Subject: [PATCH] html: impose open element stack size limit |
| 5 | + |
| 6 | +The HTML specification contains a number of algorithms which are |
| 7 | +quadratic in complexity by design. Instead of adding complicated |
| 8 | +workarounds to prevent these cases from becoming extremely expensive in |
| 9 | +pathological cases, we impose a limit of 512 to the size of the stack of |
| 10 | +open elements. It is extremely unlikely that non-adversarial HTML |
| 11 | +documents will ever hit this limit (but if we see cases of this, we may |
| 12 | +want to make the limit configurable via a ParseOption). |
| 13 | + |
| 14 | +Thanks to Guido Vranken and Jakub Ciolek for both independently |
| 15 | +reporting this issue. |
| 16 | + |
| 17 | +Fixes CVE-2025-47911 |
| 18 | +Fixes golang/go#75682 |
| 19 | + |
| 20 | +Change-Id: I890517b189af4ffbf427d25d3fde7ad7ec3509ad |
| 21 | +Reviewed-on: https://go-review.googlesource.com/c/net/+/709876 |
| 22 | +Reviewed-by: Damien Neil <dneil@google.com> |
| 23 | +LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> |
| 24 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 25 | +Upstream-reference: https://github.com/golang/net/commit/59706cdaa8f95502fdec64b67b4c61d6ca58727d.patch |
| 26 | +--- |
| 27 | + vendor/golang.org/x/net/html/escape.go | 2 +- |
| 28 | + vendor/golang.org/x/net/html/parse.go | 21 +++++++++++++++++---- |
| 29 | + 2 files changed, 18 insertions(+), 5 deletions(-) |
| 30 | + |
| 31 | +diff --git a/vendor/golang.org/x/net/html/escape.go b/vendor/golang.org/x/net/html/escape.go |
| 32 | +index d856139..8edd4c4 100644 |
| 33 | +--- a/vendor/golang.org/x/net/html/escape.go |
| 34 | ++++ b/vendor/golang.org/x/net/html/escape.go |
| 35 | +@@ -218,7 +218,7 @@ func escape(w writer, s string) error { |
| 36 | + case '\r': |
| 37 | + esc = " " |
| 38 | + default: |
| 39 | +- panic("unrecognized escape character") |
| 40 | ++ panic("html: unrecognized escape character") |
| 41 | + } |
| 42 | + s = s[i+1:] |
| 43 | + if _, err := w.WriteString(esc); err != nil { |
| 44 | +diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go |
| 45 | +index cb012d8..5ee787f 100644 |
| 46 | +--- a/vendor/golang.org/x/net/html/parse.go |
| 47 | ++++ b/vendor/golang.org/x/net/html/parse.go |
| 48 | +@@ -231,7 +231,14 @@ func (p *parser) addChild(n *Node) { |
| 49 | + } |
| 50 | + |
| 51 | + if n.Type == ElementNode { |
| 52 | +- p.oe = append(p.oe, n) |
| 53 | ++ p.insertOpenElement(n) |
| 54 | ++ } |
| 55 | ++} |
| 56 | ++ |
| 57 | ++func (p *parser) insertOpenElement(n *Node) { |
| 58 | ++ p.oe = append(p.oe, n) |
| 59 | ++ if len(p.oe) > 512 { |
| 60 | ++ panic("html: open stack of elements exceeds 512 nodes") |
| 61 | + } |
| 62 | + } |
| 63 | + |
| 64 | +@@ -810,7 +817,7 @@ func afterHeadIM(p *parser) bool { |
| 65 | + p.im = inFramesetIM |
| 66 | + return true |
| 67 | + case a.Base, a.Basefont, a.Bgsound, a.Link, a.Meta, a.Noframes, a.Script, a.Style, a.Template, a.Title: |
| 68 | +- p.oe = append(p.oe, p.head) |
| 69 | ++ p.insertOpenElement(p.head) |
| 70 | + defer p.oe.remove(p.head) |
| 71 | + return inHeadIM(p) |
| 72 | + case a.Head: |
| 73 | +@@ -2308,9 +2315,13 @@ func (p *parser) parseCurrentToken() { |
| 74 | + } |
| 75 | + } |
| 76 | + |
| 77 | +-func (p *parser) parse() error { |
| 78 | ++func (p *parser) parse() (err error) { |
| 79 | ++ defer func() { |
| 80 | ++ if panicErr := recover(); panicErr != nil { |
| 81 | ++ err = fmt.Errorf("%s", panicErr) |
| 82 | ++ } |
| 83 | ++ }() |
| 84 | + // Iterate until EOF. Any other error will cause an early return. |
| 85 | +- var err error |
| 86 | + for err != io.EOF { |
| 87 | + // CDATA sections are allowed only in foreign content. |
| 88 | + n := p.oe.top() |
| 89 | +@@ -2339,6 +2350,8 @@ func (p *parser) parse() error { |
| 90 | + // <tag>s. Conversely, explicit <tag>s in r's data can be silently dropped, |
| 91 | + // with no corresponding node in the resulting tree. |
| 92 | + // |
| 93 | ++// Parse will reject HTML that is nested deeper than 512 elements. |
| 94 | ++// |
| 95 | + // The input is assumed to be UTF-8 encoded. |
| 96 | + func Parse(r io.Reader) (*Node, error) { |
| 97 | + return ParseWithOptions(r) |
| 98 | +-- |
| 99 | +2.45.4 |
| 100 | + |
0 commit comments