Memory leak issue injecting invalid CSS into view

[chasegiunta]

Description

Though this memory leak issue has shown up with a particular plugin (CPCSS), it's most likely a deeper issue with Craft CMS and/or Yii, so raising it here.

It's not difficult to recreate. All we need is the CPCSS plugin and some text input into one of it's field settings.

Steps to reproduce

See doublesecretagency/craft-cpcss#12

Additional info

• Craft version: 3.4.15
• PHP version: 7.3.13
• Database driver & version: MySQL 5.5.5
• Plugins & versions: Control Panel CSS 2.2.1

[Mosnar]

As of Craft 3.4, CSS injected into the View is minified automatically when appropriate. It seems like there was similar behavior when unclosed comments were encountered by the CSS minification library:
tubalmartin/YUI-CSS-compressor-PHP-port#23

[lindseydiloreto]

@Mosnar That certainly aligns with what I'm seeing...

[lindseydiloreto]

It seems like the minification author isn't interested in fixing it. Does Craft itself need to be more defensive against broken CSS code?

[brandonkelly]

It seems like the minification author isn't interested in fixing it.

The maintainer claims that the issue was fixed in versions 2.4.8-p10 and 3.0.0. Craft is pulling in 4.0.0+, via mrclay/minify so should be getting that fix.

That said, it appears that the issue was fixed via tubalmartin/YUI-CSS-compressor-PHP-port@210b058, which really is fixing a bug where changing the PHP memory_limit at runtime wasn’t working correctly. Which suggests that there’s no actual bug with minifying invalid CSS, besides that it tends to take more memory to minify than valid CSS.

So @chasegiunta I’m guessing in your case the issue is that PHP isn’t allowed to change its config settings at runtime. Please help verify by changing PHP’s memory_limit to -1 (no limit), restart your web server, and see if that fixes your issue.

[chasegiunta]

Well this was fun to watch php-fpm slowly climb the memory charts over the course of the request. Eventually nginx threw a gateway timeout error but php's memory kept climbing until around 4.9 GB when something bailed. Whatever process it tries, never finishes, and thus the CP remains inaccessible.

[brandonkelly]

@chasegiunta Thanks. Able to reproduce here as well, and just posted an issue about it (tubalmartin/YUI-CSS-compressor-PHP-port#58) as well as a PR that fixes it (tubalmartin/YUI-CSS-compressor-PHP-port#59).

[chasegiunta]

Thanks @brandonkelly! Is that a similar PR fix to this one? tubalmartin/YUI-CSS-compressor-PHP-port#49 . Based on the author's activity, we may not see anything merged in anytime soon 😬. Would using a fork be an option?

[brandonkelly]

Oh, missed that. And yeah, the maintainer does seem to be MIA. Just added a guard against unclosed CSS bodies to Craft, which fixes this for the next release.

[lindseydiloreto]

Brilliant, thanks @brandonkelly! 🍺

[brandonkelly]

Craft 3.4.16 is out now with that change.

[LukeTowers]

FYI @assetic-php & @wintercms will be switching to https://github.com/wikimedia/minify since that is actively maintained, might be worth looking into.