From 600ba602b75bcad884fee75125aaf5a616fb8d91 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20W=C3=BClker?= Date: Fri, 25 Oct 2024 16:38:59 +0200 Subject: [PATCH] Limit HtmlOptionsCollection.length setter to 100k elements (#34009) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is a first step towards fixing a TIMEOUT in "html/select/options-length-too-large.html" Signed-off-by: Simon Wülker --- .../script/dom/htmloptionscollection.rs | 31 +++++++++++++------ 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/components/script/dom/htmloptionscollection.rs b/components/script/dom/htmloptionscollection.rs index eca2d217a3f..6c6cb0b8833 100644 --- a/components/script/dom/htmloptionscollection.rs +++ b/components/script/dom/htmloptionscollection.rs @@ -136,19 +136,32 @@ impl HTMLOptionsCollectionMethods for HTMLOptionsCollection { /// fn SetLength(&self, length: u32, can_gc: CanGc) { - let current_length = self.upcast().Length(); - let delta = length as i32 - current_length as i32; - match delta.cmp(&0) { + // Step 1. Let current be the number of nodes represented by the collection. + let current = self.upcast().Length(); + + match length.cmp(¤t) { + // Step 2. If the given value is greater than current, then: + Ordering::Greater => { + // Step 2.1 If the given value is greater than 100,000, then return. + if length > 100_000 { + return; + } + + // Step 2.2 Let n be value − current. + let n = length - current; + + // Step 2.3 Append n new option elements with no attributes and no child + // nodes to the select element on which this is rooted. + self.add_new_elements(n, can_gc).unwrap(); + }, + // Step 3. If the given value is less than current, then: Ordering::Less => { - // new length is lower - deleting last option elements - for index in (length..current_length).rev() { + // Step 3.1. Let n be current − value. + // Step 3.2 Remove the last n nodes in the collection from their parent nodes. + for index in (length..current).rev() { self.Remove(index as i32) } }, - Ordering::Greater => { - // new length is higher - adding new option elements - self.add_new_elements(delta as u32, can_gc).unwrap(); - }, _ => {}, } }