Skip to content

Out-of-bounds panic parsing a <meta> whose content ends in a bare charset token #763

Description

@noahskelton

Parsing a document containing a <meta http-equiv="Content-Type"> element whose content attribute ends with the token charset but no following = triggers an out-of-bounds index panic in extract_a_character_encoding_from_a_meta_element (html5ever/src/encoding.rs).

After the parser matches charset and skips trailing whitespace, position can equal input.len(). The code then does an unchecked byte access (input.as_bytes()[position]), which panics instead of reporting "no encoding found".

This appears in the wild — real pages ship malformed Content-Type values such as content="text/html; charset".

Repro

use html5ever::driver::parse_document;
use html5ever::tendril::TendrilSink;
use markup5ever_rcdom::RcDom;

fn main() {
    // panics: index out of bounds
    let html = r#"<meta http-equiv="Content-Type" content="text/html; charset">"#;
    let _ = parse_document(RcDom::default(), Default::default()).one(html);
}

Panics whenever the content value ends with charset, just charset, or charset followed by trailing whitespace.

Expected

Parsing succeeds and the meta-charset step yields no encoding, per the WHATWG algorithm's step that returns nothing once position is past the end of input.

Fixed by #762.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions