From acd9dfb715527744c9a2f61a4be59961feafec26 Mon Sep 17 00:00:00 2001 From: Albert Weichselbraun Date: Tue, 29 Sep 2026 06:19:12 +0200 Subject: [PATCH] fix: introduce a size limit for numerical css attributes. --- src/inscriptis/model/css.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/inscriptis/model/css.py b/src/inscriptis/model/css.py index 6df8ea4..9967c38 100644 --- a/src/inscriptis/model/css.py +++ b/src/inscriptis/model/css.py @@ -17,6 +17,10 @@ ) from inscriptis.model.html_element import HtmlElement +# upper limit for lenght specifications to prevent +# unbound memory allocation by malformed HTML. +MAX_EM_LEN = 100000 + class CssParse: """Parse CSS specifications and applies them to HtmlElements. @@ -68,8 +72,8 @@ def _get_em(length: str) -> int: unit = _m.group(2) if unit not in ("em", "qem", "rem"): - return round(value / 8) - return round(value) + value = value / 8 + return min(round(value), MAX_EM_LEN) # ------------------------------------------------------------------------ # css styles