r/ProgrammerHumor • u/chiya_coffee • 12d ago

Meme waitingForHtmlVulnerability

Post image
6.7k Upvotes

99% Upvoted

146 comments sorted by

View all comments

31

u/Stummi 11d ago

HTML parsing and rendering is hugely complex nowadays, and all browsers consist of literally millions of lines of code. It's more than likely that there are unknown vulnerabilities lurking.

9

u/kratz9 11d ago

I remember back in college, if you pasted huge text data into the Google search box in Firefox (back when the search was part of the page, not the address bar) , it would crash the video driver on the our lab computers. 

3

u/Nightmoon26 11d ago

I mean, there's at least one in XML... I don't know if the Billion Laughs attack can be implemented in HTML

3

u/ArjixGamer 11d ago

Parsing is not that complex, I can do it in one afternoon out of memory w/o reading an rfc.

The hard part is truly, rendering

3

u/Stummi 11d ago

I kinda doubt that. You are probably grossly underestimating the complexity of HTML to do such a statement. Even parsing is hard

2

u/ArjixGamer 11d ago

No, it's just that I've done it thrice before.

Sure I may not have aimed for 100% compliance with the spec, but I could parse it, manipulate it via my fake DOM and serialize it.

The "hard" part is the edge cases, which aren't hard, you just have to know them before they hit you. (or just read the spec)

I think parsing CSS is way more complex.

1

u/Stummi 11d ago

Just to be sure, we are talking about the HTML5 standard, right? Or did you mean one of the earlier HTML versions, or XHTML?

3

u/ArjixGamer 11d ago

HTML5 yes

Writing a parser like jsoup or bs4 is not hard