File tree Expand file tree Collapse file tree 1 file changed +17
-5
lines changed Expand file tree Collapse file tree 1 file changed +17
-5
lines changed Original file line number Diff line number Diff line change @@ -1497,15 +1497,27 @@ private function skip_script_data(): bool {
14971497 $ at += strcspn ( $ html , '-< ' , $ at );
14981498
14991499 /*
1500- * A SCRIPT close tag `</script>` must be found or this function will
1501- * return false. If a close tag would not fit in the remaining string,
1502- * no further work is necessary.
1500+ * *IMPORTANT:* Any changes to this loop *must* ensure the conditions described in this
1501+ * comment remain valid.
15031502 *
1504- * $at is potentially here
1503+ * The rest of this loop matches different byte sequences. If a script close tag is not
1504+ * found, the function will return false. The script close tag is the longest byte
1505+ * sequenced to match. Therefore, a single length check for at least 8 additional
1506+ * bytes allows for an early `false` return OR subsequent matches without length checks.
1507+ *
1508+ * $at may be here.
15051509 * ↓
15061510 * </script>
15071511 * ╰──┬───╯
1508- * $at + 8 additional characters is the minimum length required to skip script data.
1512+ * $at + 8 additional bytes are required for a non-false return value.
1513+ *
1514+ * The length of shorter matches is already satisfied:
1515+ *
1516+ * $at may be here.
1517+ * ↓
1518+ * -->
1519+ * ├╯
1520+ * $at + 2 additional characters does not require an additional length check.
15091521 */
15101522 if ( $ at + 8 >= $ doc_length ) {
15111523 return false ;
You can’t perform that action at this time.
0 commit comments