inikulin / parse5 / 42327127589

96%

master: 96%

Build Type

Pull #1921

github

Committed by fb55

Commit Message

perf(parser): keep at most 512 elements open, as WebKit does

Every search of the stack of open elements costs up to its depth per
token: the scope checks before closing a paragraph or list item, the
check whether the last formatting element is still open before text,
and the adoption agency's up to eight passes per end tag. A document of
`<b>` followed by many `<span><div>` pairs and as many `</b>` made the
agency's scans grow with the depth, which was unbounded.

WebKit and Blink stop the DOM tree at 512 nested elements
(`defaultMaximumHTMLParserDOMTreeDepth`, `kMaximumHTMLParserDOMTreeDepth`).
WebKit also closes the current element first, so its stack of open
elements never grows past that depth. The parser now does the same:
when 512 elements are open and a node is attached (an element, a void
element or a comment), the current element is closed first and the node
goes where the next one would. Template contents are not exempt, unlike
in WebKit, so the bound holds for nested templates too. With the stack
bounded, every search of it is bounded per token.

The element is closed as its end tag would close it: a formatting marker
it inserted is cleared, a template takes its insertion mode entry with
it, and an element that selects an insertion mode resets the mode
(WebKit does this for cells). An integration point is closed with its
foreign ancestors, as a breakout tag closes them, so that its content
stays HTML content. An implied `tbody`, `tr` or `colgroup` is closed
only by the element it was implied for, before it has a child, and is
removed from the tree, as parsing the serialized tree implies it again.
Comments set the current token, so the element a comment closes ends at
the comment.

A start tag is processed by the rules of the element it goes into, so
the limit closes elements before the tag is processed, not when its
element is attached: otherwise the `style` in
`<svg><foreignObject><style>` at the limit was processed as HTML content
and in... (continued)

Pull Request Pull Request #1921: Security fixes for the tokenizer, serializer, SAX parser and tree construction

Coverage Stats

621 of 624 branches covered (99.52%)

335 of 341 new or added lines in 11 files covered. (98.24%)

25 existing lines in 1 file now uncovered.

4101 of 4278 relevant lines covered (95.86%)

179373.53 hits per line