Example diff: https://en.wikipedia.org/w/index.php?title=User:Jane023/Paintings_in_the_Hermitage&diff=711865027&oldid=709806317
It takes 69 freaking seconds to render even with wikidiff2! Looking at logs, a user was waiting for it to generate for a few seconds, then tried again, resulting in two diffs being generated concurrently. This is a DoS vector, and we need to take measures to avoid having all servers render the same diff. At least diff results are cached so an attacker would need to switch between diffs to produce a long outage.
Description
Description
Status | Subtype | Assigned | Task | ||
---|---|---|---|---|---|
Resolved | • demon | T124940 MediaWiki 1.26.3 security release | |||
Resolved | • csteipp | T130947 Diff generation should use PoolCounter |
Event Timeline
Comment Actions
However, the error reporting for this patch isn't very good. Even something as simple as
'error' => function( $status ) { throw new FatalError( $status->getWikiText() ); } ]
for the error callback of PoolCounterDoWork would probably be ok if we don't expect errors to happen very often.
Comment Actions
Cool. Assuming things go smoothly with the DC transition, I'll probably deploy this tomorrow afternoon.