CSS Parser 100% CPU usage

After upgrade to 1.0.9, Horde_CSS_Parser started to take 100

Wed, 06 Apr 2016 12:57:38 +0000

After upgrade to 1.0.9, Horde_CSS_Parser started to take 100% CPU in some cases and possibly causing a DoS (when max_execution_time is disabled): 2016-04-06T14:23:09+02:00 EMERG: HORDE [imp] Maximum execution time of 120 seconds exceeded [pid 20629 on line 578 of "/usr/share/php/Horde/Css/Parser/vendor/sabberworm/php-css-parser/lib/Sabberworm/CSS/Parser.php"] 2016-04-06T14:23:08+02:00 EMERG: HORDE [imp] Maximum execution time of 120 seconds exceeded [pid 20617 on line 18 of "/usr/share/php/Horde/Css/Parser/vendor/sabberworm/php-css-parser/lib/Sabberworm/CSS/Parsing/UnexpectedTokenException.php"] 2016-04-06T14:34:29+02:00 EMERG: HORDE [imp] Maximum execution time of 120 seconds exceeded [pid 7743 on line 96 of "/usr/share/php/Horde/Css/Parser/vendor/sabberworm/php-css-parser/lib/Sabberworm/CSS/Parser.php"] Downgrading to 1.0.8 seems to fix the problem.

Wed, 06 Apr 2016 14:42:44 +0000

Can you provide an example (HTML) message that triggers this?

Any idea how to find such a message? It was triggered by our

Wed, 06 Apr 2016 14:53:27 +0000

Any idea how to find such a message? It was triggered by our users (who probably doesn't know that something like this happened).

Got it! Pls remove it from ticket after you download it, tha

Wed, 06 Apr 2016 16:53:07 +0000

Got it! Pls remove it from ticket after you download it, thank you.

Still cannot reproduce and it wouldn't have made any sense a

Wed, 06 Apr 2016 20:04:39 +0000

Still cannot reproduce and it wouldn't have made any sense anyway, since the message didn't contain any CSS at all.

I'm able to 100% reproduce it with that message. This is rel

Wed, 06 Apr 2016 21:04:02 +0000

I'm able to 100% reproduce it with that message. This is related to CSS:

Debian Wheezy, PHP 5.6.20 (from dotdeb.org), all Horde packa

Wed, 06 Apr 2016 21:06:00 +0000

Debian Wheezy, PHP 5.6.20 (from dotdeb.org), all Horde packages on newest stable versions.

I tried to replace this: with this (so message size will remain the same): aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa and problem was gone for this message.

Also this helps (but don't forget to remove 3 characters som

Wed, 06 Apr 2016 21:16:30 +0000

Also this helps (but don't forget to remove 3 characters somewhere from body): The problem is with empty