Sam Atkins ce79bc793c LibWeb/CSS: Protect against the billion-laughs attack ...

The attack unfortunately still slows us down, but this prevents us from
OOMing. Currently, we don't save the value of `var(--foo)` after
computing it once, so in this example, we end up computing `--prop1` 4
times to compute `--prop3`, but then we start again from scratch when
computing `--prop4`:

```css
  --prop1: lol;
  --prop2: var(--prop1) var(--prop1);
  --prop3: var(--prop2) var(--prop2);
  --prop4: var(--prop3) var(--prop3);
}
```

This should be solvable later if we update the computed values as we go.

2025-07-09 16:44:20 +01:00

19 KiB

Raw Blame History

View Raw