Skip to content

Close elements emitted at the nesting limit - #486

Merged
jmanico merged 1 commit into
mainfrom
fix/485-nesting-limit-close
Sep 12, 2026
Merged

Close elements emitted at the nesting limit#486
jmanico merged 1 commit into
mainfrom
fix/485-nesting-limit-close

Conversation

@jmanico

@jmanico jmanico commented Sep 12, 2026

Copy link
Copy Markdown
Member

The tag balancer emitted an element at the configured nesting limit but used one-level-stricter checks when closing it. Explicit, implicit, ancestor, and document-end closes could therefore leave sanitized HTML unbalanced.

Track whether each logical stack entry was actually sent downstream and use that fact for every close path. This also keeps close decisions correct when setNestingLimit changes while a document is open.

Regression coverage includes exact serialization, browser-tree equality, sanitizer idempotence, explicit and implicit closes, ancestor closes, document close, pushed-out/resumed table content, and a limit raise after an un-emitted resumed formatting element.

Validation:

  • ./mvnw clean verify with Homebrew OpenJDK 11, 17, 21, and 25
  • all fuzzer tests with -Djunit.seed=485, 342, and 20260911
  • 20,000 deterministic known-tag streams with legal mid-document limit changes and downstream event-balance checks

Closes #485

@jmanico
jmanico merged commit 8ca5052 into main Sep 12, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

The element at the nesting limit is written but its end tag is not

1 participant