Skip to content

Commit a8df71b

Browse files
committed
Limit the stack depth we scan looking for mis-closed DD / DT tags
Crafted HTML was getting bogged down here
1 parent e4ae6fa commit a8df71b

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

src/main/java/org/jsoup/parser/HtmlTreeBuilderState.java

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -593,7 +593,9 @@ private boolean inBodyStartTag(Token t, HtmlTreeBuilder tb) {
593593
case "dt":
594594
tb.framesetOk(false);
595595
stack = tb.getStack();
596-
for (int i = stack.size() - 1; i > 0; i--) {
596+
final int bottom = stack.size() - 1;
597+
final int upper = bottom >= MaxStackScan ? bottom - MaxStackScan : 0;
598+
for (int i = bottom; i >= upper; i--) {
597599
el = stack.get(i);
598600
if (inSorted(el.normalName(), Constants.DdDt)) {
599601
tb.processEndTag(el.normalName());
@@ -656,12 +658,14 @@ private boolean inBodyStartTag(Token t, HtmlTreeBuilder tb) {
656658
tb.error(this);
657659
return false;
658660
} else {
659-
tb.reconstructFormattingElements();
661+
if (Tag.isKnownTag(name)) // don't reconstruct for custom elements
662+
tb.reconstructFormattingElements();
660663
tb.insert(startTag);
661664
}
662665
}
663666
return true;
664667
}
668+
private static final int MaxStackScan = 24; // used for DD / DT scan, prevents runaway
665669

666670
private boolean inBodyEndTag(Token t, HtmlTreeBuilder tb) {
667671
final Token.EndTag endTag = t.asEndTag();

0 commit comments

Comments
 (0)