Changeset 3775297

Timestamp:

10/30/2026 01:01:23 PM (25 hours ago)

Author:

moustafaiub

Message:

Tagging Beta

Location:

iubenda-cookie-law-solution/tags/beta

Files:

• iubenda-cookie-class/simple_html_dom.php (modified) (3 diffs)
• readme.txt (modified) (1 diff)

iubenda-cookie-law-solution/tags/beta/iubenda-cookie-class/simple_html_dom.php

@@ -1674 +1674 @@
                         $rand = md5( uniqid( (string) mt_rand(), true ) );
                 }
-                $this->noise_prefix = '___noise___' . $rand . '_';
+                // Trailing space is deliberate: an attribute name stops at a space, so a
+                // key can never be one and noise can never be restored into that position.
+                $this->noise_prefix = '___noise___' . $rand . ' ';
                 $this->nodes = array();
                 $this->lowercase = $lowercase;
@@ -2280 +2282 @@
                 $prefix     = $this->noise_prefix;
                 $prefix_len = strlen($prefix);
-
-                while (($pos = strpos($text, $prefix)) !== false) {
+                $offset     = 0;
+
+                // The search offset only ever moves forward, so the loop is O(n) in the
+                // length of $text and can never rescan a region it has already resolved.
+                // It is the structural guarantee against the DoS: no branch below re-emits
+                // the prefix, and every branch advances $offset past the token it saw.
+                while (($pos = strpos($text, $prefix, $offset)) !== false) {
                         // A valid placeholder is the per-parse prefix followed by a 5-char
                         // numeric key. The prefix carries a random, per-parse component, so
@@ -2315 +2322 @@
                                         . $restored
                                         . substr($text, $pos + $prefix_len + 5);
+
+                                        // Resume the search at the start of the just-restored body so a
+                                        // placeholder nested inside it (e.g. a comment stashed inside a
+                                        // <script> body) is still expanded. The noise table is finite
+                                        // and each pass resolves one entry, so this still terminates.
+                                        $offset = $pos;
                                 } else {
-                                        // Unknown key: consume the whole token so the loop always
-                                        // advances and never re-emits the prefix. Re-emitting it let
-                                        // strpos() match it again on the next pass and spin forever
-                                        // while growing the string (an unauthenticated DoS).
-                                        $text = substr($text, 0, $pos)
-                                        . substr($text, $pos + $prefix_len + 5);
+                                        // Unknown key: never re-emit the prefix (that is what let the
+                                        // old guard spin forever). Leave the original bytes in place and
+                                        // step the offset past this occurrence, so content is preserved
+                                        // rather than silently deleted and the loop still advances.
+                                        $offset = $pos + $prefix_len + 5;
                                 }
                         } else {
-                                // Truncated token at the end of the string: drop just the prefix
-                                // occurrence so the loop terminates.
-                                $text = substr($text, 0, $pos)
-                                . substr($text, $pos + $prefix_len);
+                                // Truncated token at the end of the string: leave the bytes and
+                                // step past the prefix so the loop terminates without eating them.
+                                $offset = $pos + $prefix_len;
                         }
                 }

iubenda-cookie-law-solution/tags/beta/readme.txt

@@ -271 +271 @@
 * Improved: Cookie-block markers are now stripped from visitor comments, so comment content is never re-processed by the Native Blocking parser
 * Fixed: A malformed cookie-block marker could stall page rendering
-* Credit: Reported by Jakub Herman
+* Credit: Reported independently by Jakub Herman (via WPScan), via Wordfence, and by Dthangws (via Patchstack)
 
 = 3.13.6 =