jsoup Java HTML Parser release 1.14.2
Caught by the fuzz! jsoup 1.14.2 is out now, and includes a set of parser bug fixes and improvements for handling rough HTML and XML, as identified by the Jazzer JVM fuzzer. This release also includes other fixes and improvements.
jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.
Guided fuzzing is a testing method that, starting from a defined corpus, generates millions of different input files, using the instrumented codebase to steer the test harness. It attempts to adversarially create input content that leads to slow performance or unexpected exceptions. This approach finds areas in the parser that can be improved, leading to a faster and more robust implementation of jsoup.
This testing has identified particular content that could result in longer than usual parse times, or could result in unexpected exceptions including Stack Overflow, Null Pointer, and Index out of Bounds exceptions. Depending on how the parser was used, that could potentially contribute to denial of service attacks. Versions of jsoup before
1.14.2 are susceptible. We recommend that all users upgrade to this new version.
Download jsoup now.
- Improvement: support
\Eescapes in the selector regex matchers.
tel:URLs, and other URLs that are already absolute but that Java does not have input stream handlers for.
- Bugfix: when serializing output, escape characters that are in the
0 < 0x20 range. This improves XML output compatibility, and makes HTML output with these characters easier to read (as they're otherwise invisible).
- Bugfix: the
*|elwildcard namespace selector now also matches elements with no namespace.
- Bugfix: corrected a potential case of the parser input stream not being closed immediately on a read exception.
- Bugfix: when making a HTTP POST, if the request write fails, make sure the connection is immediately cleaned up.
- Bugfix: in the XML parser, XML processing instructions without attributes would be serialized as if they did.
- Bugfix: updated the HtmlTreeParser resetInsertionMode to the current spec for supported elements.
- Bugfix: fixed an NPE when parsing fragment HTML into a standalone table element.
- Bugfix: fixed an NPE when parsing fragment heading HTML into a standalone p element.
- Bugfix: fixed an IOOB when parsing a formatting fragment into a standalone p element.
- Bugfix: tag names must start with an ascii-alpha character.
- Bugfix [Fuzz]: fixed a slow parse when a tag or an attribute name has thousands of null characters in it.
- Bugfix [Fuzz]: the adoption agency algorithm can have an incorrect bookmark position
- Bugfix [Fuzz]: malformed HTML could result in null elements on stack
- Bugfix [Fuzz]: malformed deeply nested table elements could create a stack overflow.
- Bugfix [Fuzz]: Speed optimized malformed HTML creating elements with thousands of elements - limit the attribute count per element when parsing to 512 (in real-world HTML, P99 is ~ 8).
- Bugfix [Fuzz]: Speed improvement for the foster formatting elements algo, by limiting how far up a crafted stack to scan.
- Bugfix [Fuzz]: Speed improvement when parsing crafted HTML when transferring form attributes.
- Bugfix [Fuzz]: Speed improvement when the stack was thousands of items deep, and non-matching close tags sent.
- Bugfix [Fuzz]: Speed improvement when an attribute name is 600K of quote characters or otherwise needs accumulation vs being able to read in one hit.
- Bugfix [Fuzz]: Speed improvement when closing missing empty tags (in XML comment processed as HTML) when thousands deep in stack.
- Bugfix [Fuzz]: Fix a potential stack-overflow in the parser given crafted HTML, when the parser looped in the InSelectInTable state.
- Bugfix [Fuzz]: Fix an IOOB when the HTML root was cleared from the stack and then attributes were merged onto it.
- Bugfix [Fuzz]: Improved the speed of parsing when crafted HTML contains hundreds of active formatting elements that were copied for all new elements (similar to an amplification attack). The number of considered active formatting elements that will be cloned when mis-nested is now capped to 12.
My sincere thanks to everyone who contributed patches, suggestions, and bug reports. If you have any suggestions for the next release, I would love to hear them; please get in touch with me directly.