Determine the frame structure

src/org/adblockplus/android/AdblockPlus.java

 /*
  * This file is part of Adblock Plus <http://adblockplus.org/>,
  * Copyright (C) 2006-2013 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 385 matching lines @@
 
     final List<String> referrerChain = buildReferrerChain(referrer);
     Log.d("Referrer chain", url + ": " + referrerChain.toString());
     String[] referrerChainArray = referrerChain.toArray(new String[referrerChain.size()]);
     return abpEngine.matches(url, contentType, referrerChainArray);
   }
 
   private List<String> buildReferrerChain(String url)
   {
     final List<String> referrerChain = new ArrayList<String>();
-    if (url != null)
+    // We need to limit the chain length to ensure we don't block indefinitely if there's
+    // a referrer loop.
+    final int maxChainLength = 10;
+    for (int i = 0; i < maxChainLength && url != null; i++)
     {
       referrerChain.add(url);
-
-      final String referrer = referrerMapping.get(url);
-      if (referrer != null)
-        referrerChain.addAll(buildReferrerChain(referrer));
+      url = referrerMapping.get(url);
     }

[Wladimir Palant, 2013/11/27 14:00:30]

Please don't use recursive algorithms where they don't make sense. Note how this
code can allocate an unlimited number of lists, in addition to potentially
overflowing the stack. The iterative approach:

while (url != null)
{
  referrerChain.add(url);
  url = referrerMapping.get(url);
}

However, this is still a DoS vulnerability - a website can easily make us go
into an endless loop (make sure http://example.com/foo.html is recorded as
referrer of http://example.com/bar.html and http://example.com/bar.html as
referrer of http://example.com/foo.html). Limiting the size of referrerChain to
10 entries (?) should be the simplest solution, adding it to the loop condition
will do.

[Felix Dahlke, 2013/11/27 14:47:32]

Valid points, fixed.

     return referrerChain;
   }
 
   /**
    * Checks if filtering is enabled.
    */
   public boolean isFilteringEnabled()
   {
     return filteringEnabled;
   }
@@ skipping 115 matching lines @@
       Log.e(TAG, e.getMessage(), e);
     }
 
     // Set crash handler
     Thread.setDefaultUncaughtExceptionHandler(new CrashHandler(this));
 
     // Initiate update check
     scheduleUpdater(0);
   }
 }