Limit excessive selectors

Reported by @mauriceng98

Author: facelessuser

docs/src/markdown/about/changelog.md

@@ -6,6 +6,7 @@ icon: lucide/scroll-text
 ## 2.8.4
 
 -   **FIX**: Fix another inefficient attribute pattern (@mauriceng98).
+-   **FIX**: Limit total number of selectors processed in a pattern to prevent massive selector requests (@mauriceng98).
 
 ## 2.8.3
 

docs/src/markdown/api.md

@@ -26,7 +26,7 @@ change.
     > [!tip] Getting Proper Namespaces
     > The `html5lib` parser provides proper namespaces for HTML5, but `lxml`'s HTML parser will not. If you need
     > namespace support for HTML5, consider using `html5lib`.
-    > 
+    >
     > For XML, the `lxml-xml` parser (`xml` for short) will provide proper namespaces. It is generally suggested that
     > `lxml-xml` is used to parse XHTML documents to take advantage of namespaces.
 
@@ -37,6 +37,12 @@ change.
 While Soup Sieve access is exposed through Beautiful Soup's API, Soup Sieve's API can always be imported and accessed
 directly for more controlled tag selection if needed.
 
+> [!note] Selector Limits
+> Starting in 2.8.4, number of selectors in a given pattern are arbitrarily capped at ~8192. This limitation was added
+> to prevent cases where impractical, massive selectors.
+>
+> Some selectors are defined as a series of other pre-defined selectors which also contribute towards the count.
+
 ## Flags
 
 ### `soupseive.DEBUG`

soupsieve/css_parser.py

@@ -11,6 +11,8 @@
 
 UNICODE_REPLACEMENT_CHAR = 0xFFFD
 
+SELECTOR_LIMIT = 8192
+
 # Simple pseudo classes that take no parameters
 PSEUDO_SIMPLE = {
     ":any-link",
@@ -468,6 +470,13 @@ def __init__(
         self.flags = flags
         self.debug = self.flags & util.DEBUG
         self.custom = {} if custom is None else custom
+        self.count = 0
+
+    def check_count(self) -> None:
+        """Check the current selector count."""
+
+        if self.count > SELECTOR_LIMIT:
+            raise ValueError(f'Selector exceeds pseudo-class nesting limit of {SELECTOR_LIMIT}')
 
     def parse_attribute_selector(self, sel: _Selector, m: Match[str], has_selector: bool) -> bool:
         """Create attribute selector from the returned regex match."""
@@ -572,6 +581,9 @@ def parse_pseudo_class_custom(self, sel: _Selector, m: Match[str], has_selector:
             ).process_selectors(flags=FLG_PSEUDO)
             self.custom[pseudo] = selector
 
+        self.count += selector.count
+        self.check_count()
+
         sel.selectors.append(selector)
         has_selector = True
         return has_selector
@@ -603,34 +615,64 @@ def parse_pseudo_class(
             elif pseudo == ':empty':
                 sel.flags |= ct.SEL_EMPTY
             elif pseudo in (':link', ':any-link'):
+                self.count += CSS_LINK.count
+                self.check_count()
                 sel.selectors.append(CSS_LINK)
             elif pseudo == ':checked':
+                self.count += CSS_CHECKED.count
+                self.check_count()
                 sel.selectors.append(CSS_CHECKED)
             elif pseudo == ':default':
+                self.count += CSS_DEFAULT.count
+                self.check_count()
                 sel.selectors.append(CSS_DEFAULT)
             elif pseudo == ':indeterminate':
+                self.count += CSS_INDETERMINATE.count
+                self.check_count()
                 sel.selectors.append(CSS_INDETERMINATE)
             elif pseudo == ":disabled":
+                self.count += CSS_DISABLED.count
+                self.check_count()
                 sel.selectors.append(CSS_DISABLED)
             elif pseudo == ":enabled":
+                self.count += CSS_ENABLED.count
+                self.check_count()
                 sel.selectors.append(CSS_ENABLED)
             elif pseudo == ":required":
+                self.count += CSS_REQUIRED.count
+                self.check_count()
                 sel.selectors.append(CSS_REQUIRED)
             elif pseudo == ":muted":
+                self.count += CSS_MUTED.count
+                self.check_count()
                 sel.selectors.append(CSS_MUTED)
             elif pseudo == ":open":
+                self.count += CSS_OPEN.count
+                self.check_count()
                 sel.selectors.append(CSS_OPEN)
             elif pseudo == ":optional":
+                self.count += CSS_OPTIONAL.count
+                self.check_count()
                 sel.selectors.append(CSS_OPTIONAL)
             elif pseudo == ":read-only":
+                self.count += CSS_READ_ONLY.count
+                self.check_count()
                 sel.selectors.append(CSS_READ_ONLY)
             elif pseudo == ":read-write":
+                self.count += CSS_READ_WRITE.count
+                self.check_count()
                 sel.selectors.append(CSS_READ_WRITE)
             elif pseudo == ":in-range":
+                self.count += CSS_IN_RANGE.count
+                self.check_count()
                 sel.selectors.append(CSS_IN_RANGE)
             elif pseudo == ":out-of-range":
+                self.count += CSS_OUT_OF_RANGE.count
+                self.check_count()
                 sel.selectors.append(CSS_OUT_OF_RANGE)
             elif pseudo == ":placeholder-shown":
+                self.count += CSS_PLACEHOLDER_SHOWN.count
+                self.check_count()
                 sel.selectors.append(CSS_PLACEHOLDER_SHOWN)
             elif pseudo == ':first-child':
                 sel.nth.append(ct.SelectorNth(1, False, 0, False, False, ct.SelectorList()))
@@ -731,6 +773,8 @@ def parse_pseudo_nth(
             else:
                 # Use default `*|*` for `of S`.
                 nth_sel = CSS_NTH_OF_S_DEFAULT
+                self.count += nth_sel.count
+                self.check_count()
             if pseudo_sel == ':nth-child':
                 sel.nth.append(ct.SelectorNth(s1, var, s2, False, False, nth_sel))
             elif pseudo_sel == ':nth-last-child':
@@ -937,6 +981,7 @@ def parse_selectors(
         closed = False
         relations = []  # type: list[_Selector]
         rel_type = ":" + WS_COMBINATOR
+        count = self.count
 
         # Setup various flags
         is_open = bool(flags & FLG_OPEN)
@@ -984,6 +1029,10 @@ def parse_selectors(
             while True:
                 key, m = next(iselector)
 
+                if key not in ('combine', 'pseudo_close'):
+                    self.count += 1
+                    self.check_count()
+
                 # Handle parts
                 if key == "at_rule":
                     raise NotImplementedError(f"At-rules found at position {m.start(0)}")
@@ -1103,7 +1152,7 @@ def parse_selectors(
             selectors[-1].flags = ct.SEL_PLACEHOLDER_SHOWN
 
         # Return selector list
-        return ct.SelectorList([s.freeze() for s in selectors], is_not, is_html)
+        return ct.SelectorList([s.freeze() for s in selectors], is_not, is_html, self.count - count)
 
     def selector_iter(self, pattern: str) -> Iterator[tuple[str, Match[str]]]:
         """Iterate selector tokens."""

soupsieve/css_types.py

@@ -351,24 +351,27 @@ def __getitem__(self, index: int) -> str:  # pragma: no cover
 class SelectorList(Immutable):
     """Selector list."""
 
-    __slots__ = ("selectors", "is_not", "is_html", "_hash")
+    __slots__ = ("selectors", "is_not", "is_html", "count", "_hash")
 
     selectors: tuple[Selector | SelectorNull, ...]
     is_not: bool
     is_html: bool
+    count: int
 
     def __init__(
         self,
         selectors: Iterable[Selector | SelectorNull] | None = None,
         is_not: bool = False,
-        is_html: bool = False
+        is_html: bool = False,
+        count: int = 0,
     ) -> None:
         """Initialize."""
 
         super().__init__(
             selectors=tuple(selectors) if selectors is not None else (),
             is_not=is_not,
-            is_html=is_html
+            is_html=is_html,
+            count=count
         )
 
     def __iter__(self) -> Iterator[Selector | SelectorNull]:

tests/test_api.py

@@ -592,6 +592,38 @@ def test_invalid_type_input_filter(self):
         with self.assertRaises(TypeError):
             sv.filter('div', "not a tag", flags=flags)
 
+    def test_excessive_selectors(self):
+        """Test excessive selectors."""
+
+        # Build a 500 KB selector string: "a,a,a,...,a" (250,000 items)
+        count = 10000
+        selector = ",".join("a" for _ in range(count))
+
+        # Compile the selector
+        with self.assertRaises(ValueError):
+            sv.compile(selector)
+
+    def test_excessive_custom_selectors(self):
+        """Test excessive custom selectors."""
+
+        # Build a 500 KB selector string: "a,a,a,...,a" (250,000 items)
+        count = 10000
+        selector = ",".join("a" for _ in range(count))
+
+        # Compile the selector
+        with self.assertRaises(ValueError):
+            sv.compile('div:--custom', custom={':--custom': selector})
+
+    def test_excessive_custom_and_normal_selectors(self):
+        """Test excessive custom and normal selectors."""
+
+        count = 5000
+        selector = ",".join("a" for _ in range(count))
+
+        # Compile the selector
+        with self.assertRaises(ValueError):
+            sv.compile(f':is({selector}):--custom', custom={':--custom': selector})
+
 
 class TestSyntaxErrorReporting(util.TestCase):
     """Test reporting of syntax errors."""