x/net/html: ParseFragment out of memory on specially crafted input #70179
Labels
NeedsInvestigation
Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Comments
|
Related Issues and Documentation
(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.) |
seankhliao
changed the title
|
Thank you @personnumber3377 for reporting this bug. Given that this is a security bug, I shall route it to @rolandshoemaker and @golang/security. Thanks for the vector, interestingly I was fuzzing x/net/html.Parse given similar inputs found by @tr3ee in a whole range of issues for Parse. |
dr2chase
added
the
NeedsInvestigation
|
package main
import (
"golang.org/x/net/html"
"strings"
)
func main() {
html.Parse(strings.NewReader("<table><tbody><svg><td><desc><select></select></tbody>"))
} |
Local testing
This package main
import (
"golang.org/x/net/html"
"strings"
)
func main() {
html.ParseFragment(strings.NewReader("<svg><head><title><select><input>"), nil)
}Ends quickly without a problem. But this package main
import (
"golang.org/x/net/html"
"strings"
)
func main() {
html.Parse(strings.NewReader("<table><tbody><svg><td><desc><select></select></tbody>"))
}Leads to infinity processing. No memory eating at a 1 minute distance found. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Go version
go1.23.1 linux/amd64
Output of
go envin your module/workspace:What did you do?
Hi!
I originally reported this as a security issue, but this wasn't categorized as such, so I am just going to paste the original report here:
What did you see happen?
This causes an out-of-memory condition when parsing a specially crafted input.
What did you expect to see?
The program should parse the input or fail with an error, not consume all of the systems memory.
The text was updated successfully, but these errors were encountered: