File tree Expand file tree Collapse file tree 1 file changed +17
-5
lines changed Expand file tree Collapse file tree 1 file changed +17
-5
lines changed Original file line number Diff line number Diff line change @@ -1497,15 +1497,27 @@ private function skip_script_data(): bool {
1497
1497
$ at += strcspn ( $ html , '-< ' , $ at );
1498
1498
1499
1499
/*
1500
- * A SCRIPT close tag `</script>` must be found or this function will
1501
- * return false. If a close tag would not fit in the remaining string,
1502
- * no further work is necessary.
1500
+ * *IMPORTANT:* Any changes to this loop *must* ensure the conditions described in this
1501
+ * comment remain valid.
1503
1502
*
1504
- * $at is potentially here
1503
+ * The rest of this loop matches different byte sequences. If a script close tag is not
1504
+ * found, the function will return false. The script close tag is the longest byte
1505
+ * sequenced to match. Therefore, a single length check for at least 8 additional
1506
+ * bytes allows for an early `false` return OR subsequent matches without length checks.
1507
+ *
1508
+ * $at may be here.
1505
1509
* ↓
1506
1510
* </script>
1507
1511
* ╰──┬───╯
1508
- * $at + 8 additional characters is the minimum length required to skip script data.
1512
+ * $at + 8 additional bytes are required for a non-false return value.
1513
+ *
1514
+ * The length of shorter matches is already satisfied:
1515
+ *
1516
+ * $at may be here.
1517
+ * ↓
1518
+ * -->
1519
+ * ├╯
1520
+ * $at + 2 additional characters does not require an additional length check.
1509
1521
*/
1510
1522
if ( $ at + 8 >= $ doc_length ) {
1511
1523
return false ;
You can’t perform that action at this time.
0 commit comments