Cms: Memory leak issue injecting invalid CSS into view

[chasegiunta]

Description

Though this memory leak issue has shown up with a particular plugin (CPCSS), it's most likely a deeper issue with Craft CMS and/or Yii, so raising it here.

It's not difficult to recreate. All we need is the CPCSS plugin and some text input into one of it's field settings.

Steps to reproduce

See https://github.com/doublesecretagency/craft-cpcss/issues/12

Additional info

• Craft version: 3.4.15
• PHP version: 7.3.13
• Database driver & version: MySQL 5.5.5
• Plugins & versions: Control Panel CSS 2.2.1

[Mosnar]

As of Craft 3.4, CSS injected into the View is minified automatically when appropriate. It seems like there was similar behavior when unclosed comments were encountered by the CSS minification library:
https://github.com/tubalmartin/YUI-CSS-compressor-PHP-port/issues/23

[lindseydiloreto]

@Mosnar That certainly aligns with what I'm seeing...

[lindseydiloreto]

It seems like the minification author isn't interested in fixing it. Does Craft itself need to be more defensive against broken CSS code?

[brandonkelly]

It seems like the minification author isn't interested in fixing it.

The maintainer claims that the issue was fixed in versions 2.4.8-p10 and 3.0.0. Craft is pulling in 4.0.0+, via mrclay/minify so should be getting that fix.

That said, it appears that the issue was fixed via https://github.com/tubalmartin/YUI-CSS-compressor-PHP-port/commit/210b058bf9b3b43516e2c80e6db526c1ce215b04, which really is fixing a bug where changing the PHP memory_limit at runtime wasn’t working correctly. Which suggests that there’s no actual _bug_ with minifying invalid CSS, besides that it tends to take more memory to minify than valid CSS.

So @chasegiunta I’m guessing in your case the issue is that PHP isn’t allowed to change its config settings at runtime. Please help verify by changing PHP’s memory_limit to -1 (no limit), restart your web server, and see if that fixes your issue.

[chasegiunta]

Well this was fun to watch php-fpm slowly _climb the memory charts_ over the course of the request. Eventually nginx threw a gateway timeout error but php's memory kept climbing until around 4.9 GB when something bailed. Whatever process it tries, never finishes, and thus the CP remains inaccessible.

[brandonkelly]

@chasegiunta Thanks. Able to reproduce here as well, and just posted an issue about it (tubalmartin/YUI-CSS-compressor-PHP-port#58) as well as a PR that fixes it (tubalmartin/YUI-CSS-compressor-PHP-port#59).

[chasegiunta]

Thanks @brandonkelly! Is that a similar PR fix to this one? https://github.com/tubalmartin/YUI-CSS-compressor-PHP-port/pull/49 . Based on the author's activity, we may not see anything merged in anytime soon 😬. Would using a fork be an option?

[brandonkelly]

Oh, missed that. And yeah, the maintainer does seem to be MIA. Just added a guard against unclosed CSS bodies to Craft, which fixes this for the next release.

[lindseydiloreto]

Brilliant, thanks @brandonkelly! 🍺

[brandonkelly]

Craft 3.4.16 is out now with that change.