2.7.18.16: HTMLParser incremental feed is quadratic (CVE-2026-15308) - #103

…eeding (CVE-2026-15308)

Backport of python/cpython pythongh-153030 (3.14 07efb08) to 2.7.18.x.

HTMLParser.feed() concatenated each chunk onto rawdata and rescanned the
whole unparsed buffer.  While a construct stays unterminated (a comment,
processing instruction, doctype, CDATA section, start tag or RAWTEXT
element such as <script>), every feed() rescans everything buffered so
far, so feeding attacker-controlled data in small chunks takes quadratic
time.  On 2.7.18.15, 10000 64-byte chunks inside <script> take 22s
(5.6s for 5000).  feed() now collects chunks in a list and only joins
and parses once the pending data reaches a threshold: 1 byte after a
call that made progress, otherwise the current buffer size, so the
buffer must double before it is rescanned.  close() flushes pending data.
200000 chunks now take 0.1-0.3s per construct.

As upstream: when a feed() makes no progress, the events for data in
the next small feeds may be reported later (once the buffer doubles, or
at close()); no data is lost.

2.7.18.x: Lib/HTMLParser.py; del list[:] instead of list.clear().  The
cpu-gated upstream test goes in a new IncrementalFeedTestCase, plus a
test that char-by-char feeding still yields the same events and that
close() delivers held-back data.  sgmllib/htmllib keep their own feed()
and are not changed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>