Skip to content

fix quadratic scan on scheme-less input that cannot be a host - #116

Open
hey-jj wants to merge 1 commit into
robinst:mainfrom
hey-jj:fix/quadratic-schemeless-domain-scan
Open

fix quadratic scan on scheme-less input that cannot be a host#116
hey-jj wants to merge 1 commit into
robinst:mainfrom
hey-jj:fix/quadratic-schemeless-domain-scan

Conversation

@hey-jj

@hey-jj hey-jj commented Aug 24, 2026

Copy link
Copy Markdown

fixes #115

when require_host is set and maybe_host has gone false, find_authority_end kept scanning to the end of the input... every candidate did that, so extraction with url_must_have_scheme(false) goes quadratic on text like a.a~ repeated. the guard breaks out as soon as the position can no longer be part of a valid authority.

this is safe because nothing past that point can change the result: once require_host is set and maybe_host is false, the function returns (None, None) no matter where the scan stops. the ONLY state change that could revive the candidate is @ resetting maybe_host, and that can only happen while userinfo is still allowed, where the guard does not fire.

includes a regression test with a large repeated a.a~ input that hangs without the fix and runs in milliseconds with it.

When require_host is set and the current candidate can no longer be a
valid host, stop scanning instead of running to the end of the input.
Each candidate used to scan to the end, which made link extraction with
url_must_have_scheme(false) quadratic on inputs like "a.a~" repeated.

Fixes robinst#115
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Quadratic time in scheme-less domain scan on crafted plain text

1 participant