210658 - hanging with html elements: parsererror, sourcetext

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[habere-et-dispertire]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3.1) Gecko/20030618 Debian/1.3.1-3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3.1) Gecko/20030618 Debian/1.3.1-3

mozilla hangs with 100% cpu usage with the (mozilla?) browser specific html:

<parsererror> or <sourcetext>

it's not surprising that this happens with every version of mozilla since it's
in both the current and 1.0 source.


Reproducible: Always

Steps to Reproduce:
(warning: this will *hang* you mozilla)
1. open up either attached testcase

Actual Results:  
mozilla hangs

Expected Results:  
i think you're supposed to safely ignore elements you don't know.


parsererror and sourcetext defined:

http://lxr.mozilla.org/mozilla1.0/source/htmlparser/src/nsHTMLTags.cpp
http://lxr.mozilla.org/mozilla/source/htmlparser/src/nsHTMLTags.cpp

Comment 1

[habere-et-dispertire]

Attachment: parsererror testcase

warning: this will *hang* mozilla

Comment 2

[habere-et-dispertire]

Attachment: sourcetext testcase

warning: this will *hang* mozilla

Comment 3

[Mikael Parknert]

Hangs my 1.4rc3

Comment 4

[Ricardo Argüello]

Hangs my 1.4 Final

Comment 5

[Anders Kaseorg]

I recently got an HTML message from an OE user that hung Mozilla 1.5 Messenger,
and I tracked the problem down to a sourcetext element. It's enough to tell
Mozilla to open a file named hang.eml with these lines:

Content-type: text/html

<SOURCETEXT>

Comment 6

[habere-et-dispertire]

hangs my 1.8a (nightly from 2004/04/22)

Comment 7

[[e-mail]]

I'm not sure what the code is trying to achieve, but if the child element's
first root tag can't contain it then it goes into an infinite loop.

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: remove HTML support for <parsererror> and <sourcetext>

There doesn't seem to be a reason to actually support these in the HTML parser,
as these are XML tags. This patch removes support for them.

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 158551 [details] [diff] [review]
remove HTML support for <parsererror> and <sourcetext>

Looking for r=.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Fix parser/htmlparser/tools/gentags.pl as well?

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: patch v2

Sorry...forgot to include that in the diff...updated patch.

Comment 12

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 158762 [details] [diff] [review]
patch v2

r+sr=bzbarsky

Comment 13

[Boris Zbarsky [:bzbarsky]]

Checked in for 1.8a4

Comment 14

[Raphael Wegmann]

*** Bug 312844 has been marked as a duplicate of this bug. ***

Comment 15

[Adam Guthrie]

*** Bug 312870 has been marked as a duplicate of this bug. ***

Comment 16

[Daniel Veditz [:dveditz]]

This is the DoS hang described at http://www.whitedust.net/speaks/1432/ recently

Comment 17

[Daniel Veditz [:dveditz]]

Attachment: moz1.7 version of patch v2

Comment 18

[Daniel Veditz [:dveditz]]

Comment on attachment 210836 [details] [diff] [review]
moz1.7 version of patch v2

a sanity check from Blake would be good.

Comment 19

[Tim Riley [:timr]]

Comment on attachment 210836 [details] [diff] [review]
moz1.7 version of patch v2

a=timr.  Important hang to fix.

Comment 20

[Daniel Veditz [:dveditz]]

Fix checked into the moz1.7/aviary101 branches

Comment 21

[Tracy Walker [:tracy]]

verified with:
Windows:
Moz - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060215
Fx - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060215
Firefox/1.0.8
Macintosh:
Moz - Mozilla/5.0 (Macintosh; U;PPC Mac OS X Mach-O; en-US; rv:1.7.13)
Gecko/20060215 Firefox/1.0.8
Fx - Mozilla/5.0 (Macintosh; U;PPC Mac OS X Mach-O; en-US; rv:1.7.13)
Gecko/20060215 Firefox/1.0.8
Linux
Moz - Mozilla/5.0 (X11; U;Linux i686; en-US; rv:1.7.13) Gecko/20060215

Comment 22

[Vinay Prajapati]

I was opening this page https://www.fatjarstudios.com and faced the same issue.