Page MenuHomePhabricator

Remarkup objects may form rendering cycles when embedded
Closed, ResolvedPublic

Description

See also: https://hackerone.com/reports/1563142. (This link may not work if the report has not been disclosed yet.)

If you create certain types of objects which have embeddable renderings in remarkup and them put an embedded reference to the object some rendered field, we may attempt to render an infinite tree of nested objects.

You can also do this with graph cycles, etc. Previously, see D13999 for a slightly trickier situation where dashboard panels may embed themselves.

I plan to fix this by just downgrading embeds inside remarkup content to refs, since rendering shallow trees seems low-value even if we could detect cycles and stack depth and produce a more faithful result in a subset of cases.