From 875b0febde8e3b62dd4dfe6f12287aaf1e432cb2 Mon Sep 17 00:00:00 2001
From: "Edward Z. Yang" <ezyang@mit.edu>
Date: Mon, 17 May 2010 23:22:51 -0400
Subject: [PATCH] Fix infinite loop involving wrapping formedness.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
---
 NEWS                                               | 2 ++
 library/HTMLPurifier/Strategy/MakeWellFormed.php   | 8 ++++++--
 tests/HTMLPurifier/HTMLT/inline-list-loop.htmlt    | 5 +++++
 tests/HTMLPurifier/Strategy/MakeWellFormedTest.php | 4 ++--
 4 files changed, 15 insertions(+), 4 deletions(-)
 create mode 100644 tests/HTMLPurifier/HTMLT/inline-list-loop.htmlt

diff --git a/NEWS b/NEWS
index a8d9bc45..c2c20914 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
 4.1.1, unknown release date
 - Emit an error for CollectErrors if a body is extracted
 - Fix bug where in background-position for center keyword handling.
+- Fix infinite loop when a wrapper element is inserted in a context
+  where it's not allowed.  Thanks Lars <lars@renoz.dk> for reporting.
 
 4.1.0, released 2010-04-26
 ! Support proprietary height attribute on table element
diff --git a/library/HTMLPurifier/Strategy/MakeWellFormed.php b/library/HTMLPurifier/Strategy/MakeWellFormed.php
index 316b2386..c7365840 100644
--- a/library/HTMLPurifier/Strategy/MakeWellFormed.php
+++ b/library/HTMLPurifier/Strategy/MakeWellFormed.php
@@ -165,6 +165,7 @@ class HTMLPurifier_Strategy_MakeWellFormed extends HTMLPurifier_Strategy
             $token = $tokens[$t];
 
             //echo '<br>'; printTokens($tokens, $t); printTokens($this->stack);
+            //flush();
 
             // quick-check: if it's not a tag, no need to process
             if (empty($token->is_tag)) {
@@ -221,11 +222,14 @@ class HTMLPurifier_Strategy_MakeWellFormed extends HTMLPurifier_Strategy
                     }
 
                     if ($autoclose && $definition->info[$token->name]->wrap) {
-                        // check if this is actually a wrap (mmm wraps!)
+                        // Check if an element can be wrapped by another 
+                        // element to make it valid in a context (for 
+                        // example, <ul><ul> needs a <li> in between)
                         $wrapname = $definition->info[$token->name]->wrap;
                         $wrapdef = $definition->info[$wrapname];
                         $elements = $wrapdef->child->getAllowedElements($config);
-                        if (isset($elements[$token->name])) {
+                        $parent_elements = $definition->info[$parent->name]->child->getAllowedElements($config);
+                        if (isset($elements[$token->name]) && isset($parent_elements[$wrapname])) {
                             $newtoken = new HTMLPurifier_Token_Start($wrapname);
                             $this->insertBefore($newtoken);
                             $reprocess = true;
diff --git a/tests/HTMLPurifier/HTMLT/inline-list-loop.htmlt b/tests/HTMLPurifier/HTMLT/inline-list-loop.htmlt
new file mode 100644
index 00000000..0a63e895
--- /dev/null
+++ b/tests/HTMLPurifier/HTMLT/inline-list-loop.htmlt
@@ -0,0 +1,5 @@
+--HTML--
+<i><ul></ul></i>
+--EXPECT--
+<i></i><i></i>
+--# vim: et sw=4 sts=4
diff --git a/tests/HTMLPurifier/Strategy/MakeWellFormedTest.php b/tests/HTMLPurifier/Strategy/MakeWellFormedTest.php
index b7f17640..ab4bf9c2 100644
--- a/tests/HTMLPurifier/Strategy/MakeWellFormedTest.php
+++ b/tests/HTMLPurifier/Strategy/MakeWellFormedTest.php
@@ -118,8 +118,8 @@ class HTMLPurifier_Strategy_MakeWellFormedTest extends HTMLPurifier_StrategyHarn
 
     function testNestedOl() {
         $this->assertResult(
-            '<ol><ol></ol></ol>',
-            '<ol><li><ol></ol></li></ol>'
+            '<ol><ol><li>foo</li></ol></ol>',
+            '<ol><li><ol><li>foo</li></ol></li></ol>'
         );
     }