Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-38615

Very large notifications can cause OOMEs

XMLWordPrintable

      NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report.

      We had a situation where a user commented on a jira issue with a text 25MB comment. This was sent as a workbox notification to Confluence, which promptly died trying to sanitise the string:

      2015-07-24 00:35:17,952 ERROR [catalina-exec-33] [common.error.jersey.ThrowableExceptionMapper] toResponse Uncaught exception thrown by REST service: Java heap space
 -- url: /rest/mywork/1/notification | userName: <REDACTED>
java.lang.OutOfMemoryError: Java heap space
	at org.apache.xerces.dom.CharacterDataImpl.appendData(Unknown Source)
	at org.cyberneko.html.parsers.DOMFragmentParser.characters(DOMFragmentParser.java:465)
	at org.cyberneko.html.HTMLTagBalancer.characters(HTMLTagBalancer.java:798)
	at com.atlassian.xhtml.parsing.BlockIsolatingTagBalancer.characters(BlockIsolatingTagBalancer.java:171)
	at org.cyberneko.html.filters.DefaultFilter.characters(DefaultFilter.java:156)
	at org.cyberneko.html.HTMLScanner$ContentScanner.scanCharacters(HTMLScanner.java:2059)
	at org.cyberneko.html.HTMLScanner$ContentScanner.scan(HTMLScanner.java:1910)
	at org.cyberneko.html.HTMLScanner.scanDocument(HTMLScanner.java:877)
	at org.cyberneko.html.HTMLConfiguration.parse(HTMLConfiguration.java:495)
	at org.cyberneko.html.HTMLConfiguration.parse(HTMLConfiguration.java:448)
	at org.cyberneko.html.parsers.DOMFragmentParser.parse(DOMFragmentParser.java:166)
	at org.owasp.validator.html.scan.AntiSamyDOMScanner.scan(AntiSamyDOMScanner.java:172)
	at org.owasp.validator.html.AntiSamy.scan(AntiSamy.java:113)
	at org.owasp.validator.html.AntiSamy.scan(AntiSamy.java:92)
	at com.atlassian.mywork.host.service.HTMLServiceImpl.clean(HTMLServiceImpl.java:28)
	at com.atlassian.mywork.host.service.LocalNotificationServiceImpl.createOrUpdate(LocalNotificationServiceImpl.java:164)

      We should have some sort of safeguard that limits the size of notifications

            [CONFSERVER-38615] Very large notifications can cause OOMEs

            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2896631 ] New: CONFSERVER Bug Workflow v4 [ 2989533 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2788020 ] New: JAC Bug Workflow v3 [ 2896631 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2736009 ] New: JAC Bug Workflow v2 [ 2788020 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2390635 ] New: JAC Bug Workflow [ 2736009 ]
            Alex Yakovlev (Inactive) made changes -
            Labels Original: affects-cloud affects-server bugfix loyalty notifications workbox New: affects-cloud affects-server loyalty notifications workbox
            Alex Yakovlev (Inactive) made changes -
            Labels Original: affects-cloud affects-server bugfix notifications workbox New: affects-cloud affects-server bugfix loyalty notifications workbox
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 2269903 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2390635 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2220418 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 2269903 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2159543 ] New: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2220418 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 1953309 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2159543 ]

              lho@atlassian.com Le Ho (Inactive)
              drizzuto David Rizzuto
              Affected customers:
              1 This affects my team
              Watchers:
              13 Start watching this issue

                Created:
                Updated:
                Resolved: