Limit the stack depth we scan looking for mis-closed DD / DT tags

Crafted HTML was getting bogged down here
jhy · Sep 27, 2021 · a8df71b · a8df71b
1 parent e4ae6fa
commit a8df71b
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/src/main/java/org/jsoup/parser/HtmlTreeBuilderState.java b/src/main/java/org/jsoup/parser/HtmlTreeBuilderState.java
@@ -593,7 +593,9 @@ private boolean inBodyStartTag(Token t, HtmlTreeBuilder tb) {
                 case "dt":
                     tb.framesetOk(false);
                     stack = tb.getStack();
-                    for (int i = stack.size() - 1; i > 0; i--) {
+                    final int bottom = stack.size() - 1;
+                    final int upper = bottom >= MaxStackScan ? bottom - MaxStackScan : 0;
+                    for (int i = bottom; i >= upper; i--) {
                         el = stack.get(i);
                         if (inSorted(el.normalName(), Constants.DdDt)) {
                             tb.processEndTag(el.normalName());
@@ -656,12 +658,14 @@ private boolean inBodyStartTag(Token t, HtmlTreeBuilder tb) {
                         tb.error(this);
                         return false;
                     } else {
-                        tb.reconstructFormattingElements();
+                        if (Tag.isKnownTag(name)) // don't reconstruct for custom elements
+                            tb.reconstructFormattingElements();
                         tb.insert(startTag);
                     }
             }
             return true;
         }
+        private static final int MaxStackScan = 24; // used for DD / DT scan, prevents runaway
 
         private boolean inBodyEndTag(Token t, HtmlTreeBuilder tb) {
             final Token.EndTag endTag = t.asEndTag();