TechPrufer
Sign inGet started

Blogs›Cloudflare›HTML Parsing and Modification

HTML Parsing and Modification

HTML Parsing and Modification

2
posts
2016–2017

Cloudflare's HTML parsing and modification capabilities have evolved from a complex, difficult-to-maintain Ragel-based parser to a new, faster, and more maintainable streaming parser named cf-html. This evolution aims to improve the efficiency and reliability of features that modify HTML on the fly, such as email obfuscation, server-side excludes, and automatic HTTPS rewrites. The transition to cf-html is ongoing, with a focus on migrating all functionalities to the new parser. This post introduces the Automatic HTTPS Rewrites feature, which automatically upgrades HTTP resource URLs to HTTPS to fix mixed content issues, thereby ensuring full HTTPS security for websites.

2017

Incident report on memory leak caused by Cloudflare parser bug

2/24/2017

This post details a critical memory leak bug caused by Cloudflare's use of the Ragel HTML parser. The bug, present for years but only triggered under specific conditions due to changes in buffering introduced by the migration to a new parser (cf-html), allowed edge servers to return memory containing sensitive user data. The post explains the root cause as a pointer error in the Ragel-generated C code, specifically an equality check (`==`) instead of a greater-than-or-equal-to check (`>=`) when reaching the end of a buffer, combined with a missing `fhold` operation in the error handling path. The incident led to rapid mitigation by disabling affected features via global kill switches and a subsequent patch deployment. The post also highlights the ongoing migration from the old Ragel parser to the new cf-html parser.

2016

Fixing the mixed content problem with Automatic HTTPS Rewrites

9/22/2016

This post introduces the Automatic HTTPS Rewrites feature, which addresses the 'mixed content' problem by automatically upgrading HTTP resource URLs to HTTPS. It explains the dangers of mixed content (active and passive) and how browsers handle them. The post details the challenges of manually fixing mixed content and presents Automatic HTTPS Rewrites as a one-click solution that modifies links in real-time as pages pass through Cloudflare's service, ensuring that all subresources are served over HTTPS.