html: improve Noah's Ark clause performance

Instead of iterating over each element in the stack, and checking each
attribute against each other attribute in a ~cubic fashion, sort the
attributes and just use slices.Equal.

Thanks to IPC Labs for reporting this issue.

Fixes CVE-2026-25680

Change-Id: Iec3513ba0b5da4f28f1359d24846401b9ab76ee3
Reviewed-on: https://go-review.googlesource.com/c/net/+/781702
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
Reviewed-by: Nicholas Husin <nsh@golang.org>
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-by: Nicholas Husin <husin@google.com>
Auto-Submit: Gopher Robot <gobot@golang.org>
1 file changed
tree: e8f042fe54cba17bd6ca10fe7d58a98d600b7ec7
  1. bpf/
  2. context/
  3. dict/
  4. dns/
  5. html/
  6. http/
  7. http2/
  8. http3/
  9. icmp/
  10. idna/
  11. internal/
  12. ipv4/
  13. ipv6/
  14. lif/
  15. nettest/
  16. netutil/
  17. proxy/
  18. publicsuffix/
  19. quic/
  20. route/
  21. trace/
  22. webdav/
  23. websocket/
  24. xsrftoken/
  25. .gitattributes
  26. .gitignore
  27. codereview.cfg
  28. CONTRIBUTING.md
  29. go.mod
  30. go.sum
  31. LICENSE
  32. PATENTS
  33. README.md
README.md

Go Networking

Go Reference

This repository holds supplementary Go networking packages.

Report Issues / Send Patches

This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.

The git repository is https://go.googlesource.com/net.

The main issue tracker for the net repository is located at https://go.dev/issues. Prefix your issue with “x/net:” in the subject line, so it is easy to find.