The default ceiling on one d attribute, in UTF-16 code units (§96).
4 Mi units — about 4 MB. The largest d attributes that occur in practice
are detailed cartographic outlines, which run to a few hundred kilobytes; the
default is an order of magnitude above them and far below anything that could
make a linear-time parser interesting to an attacker. A caller with a
genuinely larger document raises it explicitly, which is the point: the
decision to accept a 40 MB path should appear in someone's source, not in the
absence of a check. Number.POSITIVE_INFINITY is the in-source opt-out.
The default ceiling on one
dattribute, in UTF-16 code units (§96).4 Mi units — about 4 MB. The largest
dattributes that occur in practice are detailed cartographic outlines, which run to a few hundred kilobytes; the default is an order of magnitude above them and far below anything that could make a linear-time parser interesting to an attacker. A caller with a genuinely larger document raises it explicitly, which is the point: the decision to accept a 40 MB path should appear in someone's source, not in the absence of a check.Number.POSITIVE_INFINITYis the in-source opt-out.