Stack depth limit for expand()

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 6d15504..3abd733 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -920,6 +920,7 @@ $wgMaxPPNodeCount = 1000000;  # A complexity limit on template expansion
  * stop the parser before it hits the xdebug limit.
  */
 $wgMaxTemplateDepth = 40;
+$wgMaxPPExpandDepth = 40;
 
 $wgExtraSubtitle       = '';
 $wgSiteSupportPage     = ''; # A page where you users can receive donations
@@ -2961,4 +2962,4 @@ $wgPagePropLinkInvalidations = array(
  * Maximum number of links to a redirect page listed on
  * Special:Whatlinkshere/RedirectDestination
  */
-$wgMaxRedirectLinksRetrieved = 500;
\ No newline at end of file
+$wgMaxRedirectLinksRetrieved = 500;

diff --git a/includes/ParserOptions.php b/includes/ParserOptions.php
index 7be42ab..a9c031a 100644 (file)
--- a/includes/ParserOptions.php
+++ b/includes/ParserOptions.php
@@ -23,6 +23,7 @@ class ParserOptions
        var $mTargetLanguage;            # Overrides above setting with arbitrary language
        var $mMaxIncludeSize;            # Maximum size of template expansions, in bytes
        var $mMaxPPNodeCount;            # Maximum number of nodes touched by PPFrame::expand()
+       var $mMaxPPExpandDepth;          # Maximum recursion depth in PPFrame::expand()
        var $mMaxTemplateDepth;          # Maximum recursion depth for templates within templates
        var $mRemoveComments;            # Remove HTML comments. ONLY APPLIES TO PREPROCESS OPERATIONS
        var $mTemplateCallback;          # Callback for template fetching
@@ -107,7 +108,7 @@ class ParserOptions
        function initialiseFromUser( $userInput ) {
                global $wgUseTeX, $wgUseDynamicDates, $wgInterwikiMagic, $wgAllowExternalImages;
                global $wgAllowExternalImagesFrom, $wgAllowSpecialInclusion, $wgMaxArticleSize;
-               global $wgMaxPPNodeCount, $wgMaxTemplateDepth;
+               global $wgMaxPPNodeCount, $wgMaxTemplateDepth, $wgMaxPPExpandDepth;
                $fname = 'ParserOptions::initialiseFromUser';
                wfProfileIn( $fname );
                if ( !$userInput ) {
@@ -138,6 +139,7 @@ class ParserOptions
                $this->mTargetLanguage = null; // default depends on InterfaceMessage setting
                $this->mMaxIncludeSize = $wgMaxArticleSize * 1024;
                $this->mMaxPPNodeCount = $wgMaxPPNodeCount;
+               $this->mMaxPPExpandDepth = $wgMaxPPExpandDepth;
                $this->mMaxTemplateDepth = $wgMaxTemplateDepth;
                $this->mRemoveComments = true;
                $this->mTemplateCallback = array( 'Parser', 'statelessFetchTemplate' );

diff --git a/includes/Preprocessor_DOM.php b/includes/Preprocessor_DOM.php
index f476b95..f17d704 100644 (file)
--- a/includes/Preprocessor_DOM.php
+++ b/includes/Preprocessor_DOM.php
@@ -811,6 +811,7 @@ class PPFrame_DOM implements PPFrame {
        }
 
        function expand( $root, $flags = 0 ) {
+               static $depth = 0;
                if ( is_string( $root ) ) {
                        return $root;
                }
@@ -820,6 +821,11 @@ class PPFrame_DOM implements PPFrame {
                        return '<span class="error">Node-count limit exceeded</span>';
                }
 
+               if ( $depth > $this->parser->mOptions->mMaxPPExpandDepth ) {
+                       return '<span class="error">Expansion depth limit exceeded</span>';
+               }
+               ++$depth;
+
                if ( $root instanceof PPNode_DOM ) {
                        $root = $root->node;
                }
@@ -1006,6 +1012,7 @@ class PPFrame_DOM implements PPFrame {
                                }
                        }
                }
+               --$depth;
                return $outStack[0];
        }
 

diff --git a/includes/Preprocessor_Hash.php b/includes/Preprocessor_Hash.php
index 64ed8eb..85e152c 100644 (file)
--- a/includes/Preprocessor_Hash.php
+++ b/includes/Preprocessor_Hash.php
@@ -804,6 +804,10 @@ class PPFrame_Hash implements PPFrame {
                {
                        return '<span class="error">Node-count limit exceeded</span>';
                }
+               if ( $depth > $this->parser->mOptions->mMaxPPExpandDepth ) {
+                       return '<span class="error">Expansion depth limit exceeded</span>';
+               }
+               ++$depth;
 
                $outStack = array( '', '' );
                $iteratorStack = array( false, $root );
@@ -956,6 +960,7 @@ class PPFrame_Hash implements PPFrame {
                                }
                        }
                }
+               --$depth;
                return $outStack[0];
        }