From 30c12dabdce4cd957d298f49979dd359be16b030 Mon Sep 17 00:00:00 2001
From: Raymond Hill <rhill@raymondhill.net>
Date: Mon, 19 Jul 2021 10:18:45 -0400
Subject: [PATCH] Fix infinite recursion with maliciously crafted URL

Related issue:
- https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc
---
 src/js/main-blocked.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/js/main-blocked.js b/src/js/main-blocked.js
index 74f46eaa..da4a7500 100644
--- a/src/js/main-blocked.js
+++ b/src/js/main-blocked.js
@@ -86,7 +86,7 @@ uDom('.what').text(details.url);
         return s;
     };
 
-    let renderParams = function(parentNode, rawURL) {
+    let renderParams = function(parentNode, rawURL, depth = 0) {
         let a = document.createElement('a');
         a.href = rawURL;
         if ( a.search.length === 0 ) { return false; }
@@ -108,9 +108,9 @@ uDom('.what').text(details.url);
             let name = safeDecodeURIComponent(param.slice(0, pos));
             let value = safeDecodeURIComponent(param.slice(pos + 1));
             li = liFromParam(name, value);
-            if ( reURL.test(value) ) {
+            if ( depth < 2 && reURL.test(value) ) {
                 let ul = document.createElement('ul');
-                renderParams(ul, value);
+                renderParams(ul, value, depth + 1);
                 li.appendChild(ul);
             }
             parentNode.appendChild(li);