Page MenuHomePhabricator

Preload header includes enormous data:image/png links causing header response size to be too large for certain servers, proxies and cloudflare
Closed, DuplicatePublicBUG REPORT

Description

As experienced by a MediaWiki user, who had trouble enabling CloudFlare, which disabled their skin. We discovered this was specific to the resourceloader skin module request being blocked by CloudFlare (response code 520):

http://wiki.researchrealm.net/load.php?lang=en&modules=ext.visualEditor.desktopArticleTarget.noscript%7Cskins.monobook.styles&only=styles&skin=monobook

The website owner had set their $wgLogos to a 39kb data:image/png;base64 uri of their logo (separate ticket)

This data uri then gets 'preloaded' by includes/resourceloader/ResourceLoaderModule.php into a Link header in the response of the skin style. That response is then so large that proxies like Cloudflare fail the request.

Link: <data:image/png;base64,iVBORw0KGgoAA  [..]     AAAElFTkSuQmCC>;rel=preload;as=image

We should probably have some sort of safeguard here against this, either checking for data: uris and skipping them, or by enforcing some sort of max length