HTMLPurifier Timeout Prevention

Categories

Component ID

2033663

Component name

HTMLPurifier Timeout Prevention

Component type

module

Maintenance status

Development status

Component security advisory coverage

not-covered

Component created

Component changed

Component body

If a page's html content is too complicated for HTMLPurifier to process before it exceeds php execution time, a php fatal error will get printed on the page. This project uses AJAX at form submission to test HTMLPurifier execution time to prevent this from happening:

When a user submits contents, an AJAX request sends the contents to HTMLPurifier by calling check_markup(). It waits for its response for a certain period of time (e.g. 10s). If HTMLPurifier finishes processing before then, AJAX sees the JSON object returned and the form gets submitted and we are confident that the page will not throw php execution time error. Otherwise, the form does not submit and an error message pops up on the form indicating to its user that the content is too complicated.