Page MenuHomePhabricator

Don't expose thumbnail size from Rest/Handler/SearchHandler.php
Open, Needs TriagePublic

Description

In serializeThumbnail, a SearchResultThumbnail's getSize() is exposed.

Not only is this intensive to compute (and could be an attack vector), it's also quite pointless as it's derived from thumbnails, which in turn are derived concepts for which the implementation may change.

AFAICT, none of the consumers of this API even use this data (so it's inclusion is negatively affecting them by slowing response times down)
It's also not consistently available: for most of the thumbnails, this data is usually null.

size should be removed from this API's response. And since this is the sole caller of SearchResultThumbnail->getSize() - that should probably also now be removed.

Note: T323125 already seeks to remove the expensive computation; but it should also be deprecated/removed from the API entirely.

See T321006#8376587 for more context.