When sending client hints data, the brands and fullVersionList fields are a list. Each member of these lists is inserted as a separate row in the cu_useragent_clienthints table.
There does not seem to be a limit to the number of items a user can put in these lists. I was able to submit a client hints request with 10000 entries in both of these fields, and 20000 rows were inserted in to the database.
This could be a possible vector for denial of service.
Reproduction
- Setup a wiki with CheckUser and enable client hints (they are enabled by default, you shouldn't need to do anything)
- Make an edit in Firefox (which does not support client hints)
- Find out the revision ID of the edit you just made
- Run this command, changing <rev id> to the revision ID you just found. You might need to change the address of the server as well:
curl 'http://localhost:8080/w/rest.php/checkuser/v0/useragent-clienthints/revision/<rev id>' -H 'Content-Type: application/json' \
--data-raw '{"architecture":"","bitness":"64","brands":[{"brand": "Test Brand", "version": "0"}, {"brand": "Test Brand", "version": "1"}, {"brand": "Test Brand", "version": "2"}, {"brand": "Test Brand", "version": "3"}, {"brand": "Test Brand", "version": "4"}, {"brand": "Test Brand", "version": "5"}, {"brand": "Test Brand", "version": "6"}, {"brand": "Test Brand", "version": "7"}, {"brand": "Test Brand", "version": "8"}, {"brand": "Test Brand", "version": "9"}],"fullVersionList":[{"brand": "Test Version", "version": "0"}, {"brand": "Test Version", "version": "1"}, {"brand": "Test Version", "version": "2"}, {"brand": "Test Version", "version": "3"}, {"brand": "Test Version", "version": "4"}, {"brand": "Test Version", "version": "5"}, {"brand": "Test Version", "version": "6"}, {"brand": "Test Version", "version": "7"}, {"brand": "Test Version", "version": "8"}, {"brand": "Test Version", "version": "9"}],"mobile":false,"model":"","platform":"Linux","platformVersion":"5.10.0"}'- Go to the database and run SELECT * FROM cu_useragent_clienthints;
Other information
Only wmf and the master branch of CheckUser has this issue. There will be no need to keep this private after the patch is in production as only local testing wikis should have this issue until it's merged into the master branch.