Last modified: 2011-05-20 12:52:23 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T30738, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 28738 - GET variable for load.php might exceed 512 bytes
GET variable for load.php might exceed 512 bytes
Status: RESOLVED FIXED
Product: MediaWiki
Classification: Unclassified
ResourceLoader (Other open bugs)
1.18.x
All All
: Normal normal (vote)
: ---
Assigned To: Trevor Parscal
:
: 29056 (view as bug list)
Depends on:
Blocks: 24415
  Show dependency treegraph
 
Reported: 2011-04-28 18:57 UTC by Ivan Lanin
Modified: 2011-05-20 12:52 UTC (History)
7 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Ivan Lanin 2011-04-28 18:57:23 UTC
Perhaps this is not a bug, but I don't know where to document it as I thought some users will experience the same problem. Please point me to where I can document this.

My hosting provider use suhosin. I found that on some pages (in my case, a LiquidThreads talk page) the value of GET variable for load.php exceeds 512 bytes, the default maximum value length of suhosin.

Here's the sample:

debug=false&lang=id&modules=ext.liquidThreads%7Cjquery.autoEllipsis%7Cjquery.checkboxShiftClick%7Cjquery.client%7Cjquery.collapsibleTabs%7Cjquery.cookie%7Cjquery.delayedBind%7Cjquery.highlightText%7Cjquery.makeCollapsible%7Cjquery.messageBox%7Cjquery.placeholder%7Cjquery.suggestions%7Cjquery.tabIndex%7Cjquery.tablesorter%7Cjquery.ui.button%7Cjquery.ui.core%7Cjquery.ui.dialog%7Cjquery.ui.draggable%7Cjquery.ui.mouse%7Cjquery.ui.position%7Cjquery.ui.resizable%7Cjquery.ui.widget%7Cmediawiki.action.watch.ajax%7Cmediawiki.language%7Cmediawiki.legacy.ajax%7Cmediawiki.legacy.wikibits%7Cmediawiki.util&skin=vector

Workaround: Sets suhosin.get.max_value_length in PHP ini to a number greater than 512. I use 1024.

suhosin.get.max_value_length = 1024
Comment 1 Trevor Parscal 2011-04-28 19:06:32 UTC
Another solution would be to automatically split up requests on the client if the get query is going to be too long. I prefer however the server config change option.
Comment 2 Mark A. Hershberger 2011-04-29 19:02:14 UTC
I think this should be detected during installation, right?  Printing a warning then would be a good time to tell the person installing that they need to change things.
Comment 3 Roan Kattouw 2011-04-29 20:01:51 UTC
(In reply to comment #2)
> I think this should be detected during installation, right?  Printing a warning
> then would be a good time to tell the person installing that they need to
> change things.
Good idea.
Comment 4 Max Semenik 2011-04-29 20:10:45 UTC
Possible URL reduction method:

&modules=jquery:autoEllipsis,checkboxShiftClick,client,collapsibleTabs|jquery.ui:button,core,dialog

In addition to saving on module names, it also sends 1 byte for comma instead of 3 bytes for pipe which you have to percent-encode.
Comment 5 Brion Vibber 2011-04-29 21:31:35 UTC
Note that an installation-time check isn't necessarily sufficient -- if your hosting provider changes their configuration later on, you won't be warned.

Max's suggestion at shortening the URLs by collapsing out common prefixes is quite clever, though dependency ordering may mean that doesn't always work in an optimized fashion. It also won't protect against a few more modules coming in and bumping it beyond the limit again...
Comment 6 Roan Kattouw 2011-04-29 21:33:11 UTC
(In reply to comment #5)
> Note that an installation-time check isn't necessarily sufficient -- if your
> hosting provider changes their configuration later on, you won't be warned.
> 
> Max's suggestion at shortening the URLs by collapsing out common prefixes is
> quite clever, though dependency ordering may mean that doesn't always work in
> an optimized fashion. It also won't protect against a few more modules coming
> in and bumping it beyond the limit again...
Dependency ordering is irrelevant. The order of modules in the query string determines the order in which they are delivered, yes, but the client-side loader is smart enough to execute everything in the right order regardless of which order the delivery order.
Comment 7 Max Semenik 2011-04-30 06:22:36 UTC
(In reply to comment #6)

> Dependency ordering is irrelevant. The order of modules in the query string
> determines the order in which they are delivered, yes, but the client-side
> loader is smart enough to execute everything in the right order regardless of
> which order the delivery order.

Furthermore, the module list is always sorted before it's turnd into query string.
Comment 8 Mark A. Hershberger 2011-04-30 18:22:36 UTC
> Note that an installation-time check isn't necessarily sufficient --
> if your hosting provider changes their configuration later on, you
> won't be warned.

Agreed.  This really goes for almost all the warnings at installation.

Further, I like WordPress's admin interface that lets you know when an
update is available for WP itself or for one of the WP extensions.  I
think some work has already been done in that way,

So, I probably need to file a new bug requesting this admin page
feature that would provide all sorts of warnings (“Security upgrade
available”, “Suhosin flags are wrong”, etc.
Comment 9 Mark A. Hershberger 2011-04-30 18:30:31 UTC
See bug #28760 for the new bug.
Comment 10 Andrew Garrett 2011-05-01 08:21:33 UTC
(In reply to comment #1)
> Another solution would be to automatically split up requests on the client if
> the get query is going to be too long. I prefer however the server config
> change option.

This is by far the most robust solution, in my opinion.
Comment 11 Roan Kattouw 2011-05-01 08:26:36 UTC
I'll work on this today and implement both Trevor/Andrew's suggestion (split up requests if too long) and Max's suggestion (shorten URLs drastically so this hopefully doesn't ever happen in practice). I would like requests to be broken up as infrequently as possible, because every time that happens we take a performance hit.
Comment 12 Daniel Friesen 2011-05-01 09:17:49 UTC
(In reply to comment #11)
> I'll work on this today and implement both Trevor/Andrew's suggestion (split up
> requests if too long) and Max's suggestion (shorten URLs drastically so this
> hopefully doesn't ever happen in practice). I would like requests to be broken
> up as infrequently as possible, because every time that happens we take a
> performance hit.

Try doing it with a config option, that way those who can optimize their setup to avoid splitting up requests where they would be by default.
Comment 13 Roan Kattouw 2011-05-01 18:44:09 UTC
Configurable requests splitting implemented in r87203. I'll refine this later by checking for suhosin.get.max_value_length in the installer and setting $wgResourceLoaderMaxQueryLength appropriately in the generated LocalSettings.php file, and by implementing the parameter shortening scheme MaxSem suggested.
Comment 14 Roan Kattouw 2011-05-05 11:53:52 UTC
Installer check added in r87494. This makes sure fresh installs with suhosin.get.max_value_length set will have the appropriate value for $wgResourceLoaderMaxQueryLength in their LocalSettings.php ; not sure how to do this cleanly for upgrades, will ask Chad.
Comment 15 Roan Kattouw 2011-05-05 13:01:34 UTC
(In reply to comment #4)
> In addition to saving on module names, it also sends 1 byte for comma instead
> of 3 bytes for pipe which you have to percent-encode.
Turns out that's not true: jQuery is encoding my commas and colons as well.
Comment 16 Roan Kattouw 2011-05-05 13:54:21 UTC
(In reply to comment #4)
> Possible URL reduction method:
> 
> &modules=jquery:autoEllipsis,checkboxShiftClick,client,collapsibleTabs|jquery.ui:button,core,dialog
> 
Implemented this in r87497, except that I'm using dots instead of colons because 1) that's one fewer character with a special meaning and 2) the fact that a dot is one character after urlencoding but a colon is three is inconvenient when doing the query string length bookkeeping required to avoid hitting the limit.

So the URL from your example now looks like this:

&modules=jquery.autoEllipsis,checkboxShiftClick,client,collapsibleTabs|jquery.ui.button,core,dialog

Closing this bug as FIXED because I believe I've done every reasonable thing that can be done to address this issue. Maybe we can do something in the upgrader too, but I'll have to ask Chad about that.
Comment 17 Roan Kattouw 2011-05-20 12:52:23 UTC
*** Bug 29056 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links