Denial of Service Vulnerability in JustHTML Package Due to Uncontrolled Recursion

Background

JustHTML is a Python library designed for parsing and manipulating HTML documents. It provides a simple interface for converting HTML to various formats and allows users to traverse and modify the DOM tree. However, versions up to 1.9.1 are vulnerable to a denial of service (DoS) attack through deeply nested HTML structures, which can lead to unhandled recursion errors during parsing.

Vulnerability Detail

The vulnerability arises from the JustHTML library's handling of deeply nested HTML elements. Specifically, the TreeBuilder.finish() method calls _populate_selectedcontent(), which in turn invokes _find_elements() recursively without a depth limit. This can lead to a RecursionError when the depth of the DOM tree exceeds CPython's default recursion limit of 1000. An attacker can exploit this by supplying HTML with excessive nesting, causing the application to crash or terminate unexpectedly. The vulnerability affects multiple recursive functions within the library, making it a significant risk for applications relying on JustHTML for HTML parsing.

pip install --upgrade "justhtml==1.10.0"

Workaround

If immediate updating is not possible, consider implementing exception handling in your application to catch RecursionError exceptions during the parsing process. This can prevent the application from crashing, although it does not eliminate the underlying vulnerability. Here is an example of how to handle the exception:

try: doc = JustHTML(html) except RecursionError: print('Recursion limit exceeded. Please provide less nested HTML.')

Conclusion

The JustHTML library is vulnerable to a denial of service attack due to uncontrolled recursion in its HTML parsing methods. Users are strongly advised to update to version 1.10.0 or later to mitigate this risk. Implementing exception handling can serve as a temporary workaround while transitioning to the patched version.

See every vulnerability recorded for justhtml →

FAQ