Osclass 5.1b3 - Out of Memory

eurobank commented 3 years ago

Today i got a warning from Google webmaster service about several error 500 issues.

The url is:

https: // www . website . com/index.php?page=ajax&action=location

So enabling debug log, i see several of these and they DO happen when the above url is accessed. I have no idea when this url is used.

2021-11-06 23:10:09 - ERROR: Allowed memory size of 268435456 bytes exhausted (tried to allocate 20480 bytes) in /home/oc-includes/osclass/classes/controller/CWebAjax.php on line no 64 Error Code:1 with context: 
'array (
  \'type\' => 1,
  \'message\' => \'Allowed memory size of 268435456 bytes exhausted (tried to allocate 20480 bytes)\',
  \'file\' => \'/home/oc-includes/osclass/classes/controller/CWebAjax.php\',
  \'line\' => 64,
)'

Never seen those before.

eurobank commented 3 years ago

The above happens to a multi country site.

Trying the same url to a single country site, i get a huge page like this (instead of a white screen of death with out of memory):

eurobank commented 3 years ago

Is all that considered as a security issue? What other data can be "fished" using this trick?

navjottomer commented 3 years ago

This is a ajax url for fetching location data. It'll give all the location data. For a multi country site, it is performance hog. I'll see what we can do to optimize it, till then increase your PHP memory limit.

eurobank commented 3 years ago

Ok, still why a direct PHP file returns some results to visitors? Is that correct or safe, i think not.

navjottomer commented 3 years ago

Those urls are meant that way, and data given there is safe.

On Sun, 7 Nov, 2021, 7:26 pm eurobank, @.***> wrote:

Ok, still why a direct PHP file returns some results to visitors? Is that correct or safe, i think not.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/mindstellar/Osclass/issues/434#issuecomment-962615012, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAIDQSNG427CXETFKXLX3T3UK2APZANCNFSM5HQDONBA .

eurobank commented 3 years ago

ok, safe. But 26 mb in my case and i don't understand why google bot (and probably others) want to dowload/get it.

anyways....

dev-101 commented 3 years ago

It also happens with original script, you must manually define rules in robots.txt

eurobank commented 3 years ago

Maybe so, i haven't seen that ever.

dev-101 commented 3 years ago

It crawls anything it finds, it doesn't care unless you explicitly forbid access to it.

Also, those pages are ajax related stuff, but the issue here is that you also need to prevent them from indexing (robots.txt is not good enough, e.g. bots ignore them for that part).

One possible way to solve it on an application level is to try to detect direct ajax call coming from bots, and to serve a blank nofollow, noindex html page in those cases. Otherwise, you must define them manually in GSC and alike.

eurobank commented 3 years ago

True, i have found some old 3.9 of mine still running and tested it. It happens also. But never had an out of memory issue.

Anyways, if this is not a security issue, i'm fine.

mindstellar / Osclass

Osclass 5.1b3 - Out of Memory #434