Page MenuHomePhabricator

Avoid unnecessary encoding of '<', '>' and '&' in output of load.php
Closed, DeclinedPublic

Description

The styles and messages delivered by load.php contains unnecessary escaped characters like \u003E instead of >. Escaping of <, > and & is not needed here and is a waste of traffic.

Examples:

Event Timeline

Change 526385 had a related patch set uploaded (by Fomafix; owner: Fomafix):
[mediawiki/core@master] ResourceLoader: Avoid escaping of characters in styles

https://gerrit.wikimedia.org/r/526385

Fomafix renamed this task from Remove unnecessary escaping in styles to Remove unnecessary escaping of '<', '> and '&' in styles and messages.Aug 1 2019, 6:28 PM
Fomafix renamed this task from Remove unnecessary escaping of '<', '> and '&' in styles and messages to Remove unnecessary escaping of '<', '>' and '&' in styles and messages.
Fomafix updated the task description. (Show Details)

Change 535266 had a related patch set uploaded (by Fomafix; owner: Fomafix):
[mediawiki/core@master] [WIP] resourceloader: Move encodeJsonForScript to ResourceLoaderContext

https://gerrit.wikimedia.org/r/535266

Fomafix renamed this task from Remove unnecessary escaping of '<', '>' and '&' in styles and messages to Avoid unnecessary encoding of '<', '>' and '&' in output of load.php.Sep 12 2019, 11:18 AM

Change 535266 merged by jenkins-bot:
[mediawiki/core@master] resourceloader: Add $context to static functions in ResourceLoader

https://gerrit.wikimedia.org/r/535266

Change 526385 abandoned by Krinkle:
[mediawiki/core@master] resourceloader: Avoid HTML encoding in output of load.php

Reason:
I'm declining this for sake of simplicitly. The optimisation is imho not worth the complexity and security risk, and I rather like the idea that we are "just" sending load.php responses into <script> tags, essentially following the preload / "Facebook BigPipe" idea. Separating the two would require every possible byte that might make its way into the response to be split and injected and made aware of this which I think is too big of a gamble and limitation to enforce on the whole stack.

https://gerrit.wikimedia.org/r/526385