From b203767393ffcab25cdab3043252e841e37f7859 Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Thu, 24 Sep 2026 20:01:27 -0700 Subject: [PATCH] Add the change log entry for 20260924.2 The release workflow turns "Next release" into the release entry and refuses to run without one. Describe what #510 changed for users, which is nothing in output: the lexer's walk keeps its bound as a second line of defence, and the nesting limit is documented as able to drop valid CSS such as a deeply nested later branch of if(). Co-Authored-By: Claude Opus 5.5 --- change_log.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/change_log.md b/change_log.md index 314d0806..efdf13e4 100644 --- a/change_log.md +++ b/change_log.md @@ -1,6 +1,16 @@ # OWASP Java HTML Sanitizer Change Log Most recent at top. + * Next release + * Follow-ups to the CSS nesting limit in 20260924.1, with no change in + output. The CSS lexer keeps a bound on its search for a close + bracket's partner, so that if its count of open brackets ever + drifted, the bracket would be dropped rather than an exception thrown + out of `sanitize()`. And the limit is now documented as able to drop + valid CSS: it counts functions after a semicolon inside a function, + such as the later branches of `if()`, which the parser never reads, + so such a declaration can be dropped whole for nesting the parser + would not have reached. * Release 20260924.1 * A CSS declaration whose value nests functions more than sixteen deep is dropped whole instead of parsed. The CSS grammar recurses once per