fix(rendering): refuse unsupported markup as an error and keep large documents linear #51

Open

james.maes wants to merge 1 commits from fix/renderer-input-bounds into main

pull from: fix/renderer-input-bounds

Author	SHA1	Message	Date
james.maesandClaude Fable 5.2	b095d1a183	fix(rendering): refuse unsupported markup as an error and keep large documents linear node / node (push) Successful in 14s Details build / scripts (push) Successful in 14s Details windows / windows (push) Successful in 1m57s Details build / windows (push) Successful in 1m57s Details Element nesting is bounded before any library walks the parsed tree: a count kept while tokens arrive stops runaway input early, and an exact measurement of the parsed tree applies the limit of 256 levels. The renderer parses once with the sanitizer's own settings and sanitizes that tree, so the bound is enforced between the parse and the sanitizer's passes. Deeper markup is an ArgumentException, which the reader already reports as an unsupported document. An unterminated script or comment can report a text run past the end of its block, and malformed markup can report one that starts inside another; both are handled instead of failing the open. Raw-text formatting is applied in one forward pass, and repeated heading titles continue from the last anchor suffix used, so neither grows with the square of the document. DocumentOutline accepts a cancellation token that is honoured between its phases. The threat model states that nesting is bounded and parse time is not. Closes #50 Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com> Signed-off-by: James Maes <james@kof22.com>	2026-11-10 17:19:26 -06:00

Author

SHA1

Message

Date

james.maesandClaude Fable 5.2

b095d1a183

fix(rendering): refuse unsupported markup as an error and keep large documents linear

node / node (push) Successful in 14s

Details

build / scripts (push) Successful in 14s

Details

windows / windows (push) Successful in 1m57s

Details

build / windows (push) Successful in 1m57s

Details

Element nesting is bounded before any library walks the parsed tree: a
count kept while tokens arrive stops runaway input early, and an exact
measurement of the parsed tree applies the limit of 256 levels. The
renderer parses once with the sanitizer's own settings and sanitizes that
tree, so the bound is enforced between the parse and the sanitizer's
passes. Deeper markup is an ArgumentException, which the reader already
reports as an unsupported document.

An unterminated script or comment can report a text run past the end of
its block, and malformed markup can report one that starts inside
another; both are handled instead of failing the open. Raw-text
formatting is applied in one forward pass, and repeated heading titles
continue from the last anchor suffix used, so neither grows with the
square of the document. DocumentOutline accepts a cancellation token that
is honoured between its phases.

The threat model states that nesting is bounded and parse time is not.

Closes #50

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

2026-11-10 17:19:26 -06:00