GHSA-r8cj-3554-33mr justhtml introduces denial-of-service hardening
Summary`justhtml` `1.18.0` fixes multiple low-severity denial-of-service hardening issues in CSS selector handling and linkification.These issues are availability concerns. They do not allow script execution, data disclosure, or sanitizer bypass by themselves.Affected versions`justhtml` `< 1.18.0`Fixed version`justhtml` `1.18.0` released on May 4, 2026ImpactCSS selector handlingApplications that evaluate attacker-controlled selector strings, or that run selector-based transform pipelines over attacker-controlled documents, could consume disproportionate CPU or memory.The affected selector patterns included oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes such as `:not(...)`, repeated attribute/class token matching over large values, repeated sibling or ancestor scans, repeated positional pseudo-class work, and `:contains(...)` over large descendant text.Programmatically constructed malformed DOM graphs could also trigger non-terminating or duplicate traversal in some selector paths, including cyclic/shared child graphs, cyclic parent chains, and cyclic text traversal for `:contains(...)`.LinkificationAttacker-controlled text containing punctuation-heavy input or URL candidates ending in long runs of unmatched closing brackets could cause repeated rescanning and consume disproportionate CPU when linkification was enabled.Default configurationOrdinary sanitization of parsed HTML with the default `JustHTML(..., sanitize=True)` configuration is not expected to expose untrusted users to selector injection, because selectors are normally supplied by application code.The main risk areas are:applications that accept selector strings from untrusted users and pass them to `query(...)`, `matches(...)`, or selector-based transformscustom transform or sanitization pipelines that run selector matching over very large untrusted documentsapplications that construct or mutate DOM trees programmatically from untrusted structureapplications that enable `Linkify(...)` over attacker-controlled textFixes in 1.18.0`1.18.0` adds generalized selector resource controls and removes several repeated-work hot paths:shared selector limits for parse and match operationsstructural caps for selector length, selector lists, compound selectors, complex selectors, and parse depthmatch-operation and string-byte budgetsper-query matcher state for caches and cycle guardsprecomputed or cached ancestor, sibling, positional, attribute-token, text-content, `:not(...)`, `:empty`, and `:nth-child(...)` workconsistent enforcement across public parsing, `query(...)`, tag-only query fast paths, transform selector compilation, and sanitization transform matchinglinkification hardening for punctuation-heavy inputs and trailing bracket trimmingCWE mappingCWE-400: Uncontrolled Resource ConsumptionCWE-407: Inefficient Algorithmic ComplexityCWE-835: Loop with Unreachable Exit ConditionRecommended actionUpgrade to `justhtml` `1.18.0`.If users cannot upgrade immediately:do not pass untrusted selector strings to `query(...)`, `matches(...)`, or selector-based transformsrestrict the size of untrusted documents before selector matching or linkificationavoid constructing programmatic DOM graphs from untrusted structureavoid enabling `Linkify(...)` on very large attacker-controlled textCreditDiscovered during an internal security review of `justhtml`.