[release-4.22] OCPBUGS-101535: Address CVE-2026-42502 - #1579
[release-4.22] OCPBUGS-101535: Address CVE-2026-42502#1579ocp-sustaining-admins wants to merge 2 commits into
Conversation
This commit was automatically generated by the ARC system to address CVE-2026-42502. Changes were generated using the following commands: ./ $ go1.25.12 get golang.org/x/net/html@v0.55.0 ./ $ go1.25.12 mod tidy ./ $ go1.25.12 mod vendor
This commit was automatically generated by the ARC system to address CVE-2026-42502. Changes were generated using the following commands: ./ $ go1.25.12 get golang.org/x/net/html@v0.55.0 ./ $ go1.25.12 mod tidy ./ $ go1.25.12 mod vendor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci-robot
added
jira/severity-moderate
|
@ocp-sustaining-admins: This pull request references Jira Issue OCPBUGS-101535, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ocp-sustaining-admins The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @ocp-sustaining-admins. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
the
needs-ok-to-test
Code Review by Qodo
1. End-tag attr allocation
|
![qodo-for-rh-openshift[bot]](https://avatars.githubusercontent.com/u/792337?s=60&v=4){kind=small}
| // Save pendingAttr if saveAttr and that attribute has a non-empty key, and the key hasn't been seen before. | ||
| key := strings.ToLower(string(z.buf[z.pendingAttr[0].start:z.pendingAttr[0].end])) | ||
| if saveAttr && z.pendingAttr[0].start != z.pendingAttr[0].end && !z.attrNames[key] { | ||
| z.attr = append(z.attr, z.pendingAttr) |
There was a problem hiding this comment.
1. End-tag attr allocation 🐞 Bug ➹ Performance
vendor/golang.org/x/net/html.Tokenizer.readTag now always allocates/lowercases an attribute name string even when saveAttr is false (the EndTagToken path), doing unnecessary work on malformed end tags whose attributes are discarded. This can amplify CPU/allocation costs proportional to attacker-controlled HTML size in code paths that tokenize arbitrary HTML bodies.
Agent Prompt
## Issue description
`Tokenizer.readTag` computes `key := strings.ToLower(string(...))` unconditionally for each parsed attribute, even when `saveAttr == false` (used when tokenizing end tags). This introduces avoidable allocations and CPU work on inputs where end tags contain many/large (invalid) attributes.
## Issue Context
`Next()` calls `readTag(false)` for end tags, so this work is performed even when attributes are not retained.
## Fix Focus Areas
- vendor/golang.org/x/net/html/token.go[868-894]
- vendor/golang.org/x/net/html/token.go[1086-1108]
## Suggested fix
Move the `key := strings.ToLower(...)` computation inside the `if saveAttr && ...` block (and only compute it when the pending attribute key is non-empty), so the end-tag path (`saveAttr=false`) does not allocate/lowercase attribute keys at all.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
PR Summary by Qodo[release-4.22] Fix CVE-2026-42502 by updating golang.org/x/net/html to v0.55.0
AI Description
Diagram
High-Level Assessment
Files changed (174)
|
2 participants
This is an automated PR from the ARC system.
This change addresses CVE-2026-42502 by updating golang.org/x/net/html on branch release-4.22.
Changes were generated using the following commands:
A member of the Red Hat Openshift Sustaining Team will review the PR and take appropriate action.
Common PR issues and how to fix them:
Title needs to be changed:
This might be needed if a PR references multiple Jira issues and some of them have been closed as duplicates.
Use
/retitle <NEW TITLE>command from openshift-ci botopenshift-ci bot commands
verify-commitscheck is failing:Commits need to be in the format
UPSTREAM: PR#|<carry>|<drop>: <commit message>.You can do achieve this by doing one of the following:
git commit --amend -m <commit message>and force pushing the changes to the fork.verify-commits documentation