From ee3b12b547ef391dca21a1b363ab829ff06a4552 Mon Sep 17 00:00:00 2001
From: Peter McDade <pmcdade@pmcdadePersonal.pmcdade.org>
Date: Sun, 22 Feb 2026 13:17:30 -0500
Subject: [PATCH] fix(xml): remove recursive sublanguage references to prevent
 ReDoS

Remove `xml` from the sublanguage fallback arrays in `<style>` and
`<script>` tag handling. Also remove `handlebars` from `<script>`
since handlebars itself uses xml as its base sublanguage, creating
an indirect recursion path (xml -> handlebars -> xml).

The recursive sublanguage references allow crafted input with many
unclosed `<script>` tags to cause exponential backtracking, leading
to resource exhaustion (denial of service).

Fixes #4261

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/languages/xml.js                                | 11 ++---------
 test/markup/xml/sublanguage_no_relevancy.expect.txt |  6 +++---
 2 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/src/languages/xml.js b/src/languages/xml.js
index 31f11e6866..00d059945c 100644
--- a/src/languages/xml.js
+++ b/src/languages/xml.js
@@ -161,10 +161,7 @@ export default function(hljs) {
         starts: {
           end: /<\/style>/,
           returnEnd: true,
-          subLanguage: [
-            'css',
-            'xml'
-          ]
+          subLanguage: 'css'
         }
       },
       {
@@ -177,11 +174,7 @@ export default function(hljs) {
         starts: {
           end: /<\/script>/,
           returnEnd: true,
-          subLanguage: [
-            'javascript',
-            'handlebars',
-            'xml'
-          ]
+          subLanguage: 'javascript'
         }
       },
       // we need this for now for jSX
diff --git a/test/markup/xml/sublanguage_no_relevancy.expect.txt b/test/markup/xml/sublanguage_no_relevancy.expect.txt
index 07a82d554a..64ceb032f1 100644
--- a/test/markup/xml/sublanguage_no_relevancy.expect.txt
+++ b/test/markup/xml/sublanguage_no_relevancy.expect.txt
@@ -1,3 +1,3 @@
-<span class="hljs-tag">&lt;<span class="hljs-name">script</span>&gt;</span>foo();<span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>
-<span class="hljs-tag">&lt;<span class="hljs-name">script</span>&gt;</span>booger<span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>
-<span class="hljs-tag">&lt;<span class="hljs-name">script</span>&gt;</span>hjk<span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>
+<span class="hljs-tag">&lt;<span class="hljs-name">script</span>&gt;</span><span class="language-javascript"><span class="hljs-title function_">foo</span>();</span><span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>
+<span class="hljs-tag">&lt;<span class="hljs-name">script</span>&gt;</span><span class="language-javascript">booger</span><span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>
+<span class="hljs-tag">&lt;<span class="hljs-name">script</span>&gt;</span><span class="language-javascript">hjk</span><span class="hljs-tag">&lt;/<span class="hljs-name">script</span>&gt;</span>