Avoid taking more than O(n) time even for malicious input
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 2.6k
- Forks
- 288
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 8
Description
HTML parsers are not just used in client-side applications: they are also used on servers, such as in HTML sanitizers. html5ever (and xml5ever) should guarantee that they cannot be coerced into taking more than O(n), or at worst O(n log n), time. This may be difficult, especially if one does not want to use massively connected datastructures.
Right now, it seems that the worst offenders are likely to be calls to Vec::remove in various places, such as in the adoption agency algorithm.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the adoption agency algorithm and the mentioned Vec::remove calls in html5ever and xml5ever. Identify input patterns that cause superlinear behavior and measure parser runtime against input size. Done means malicious input cannot force more than O(n), or at worst O(n log n), time.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend, performance
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100