[MGNLUI-7018] comboBox fails when dataProvider size > 500 Created: 19/Jan/22  Updated: 19/Jul/22  Resolved: 01/Apr/22

Status: Closed
Project: Magnolia UI
Component/s: None
Affects Version/s: 6.2.15
Fix Version/s: 6.2.18, 6.3.0

Type: Bug Priority: Neutral
Reporter: Carlos Cantalapiedra Assignee: Quach Hao Thien
Resolution: Fixed Votes: 0
Labels: VN-Testing, nucleus
Remaining Estimate: Not Specified
Time Spent: 3d 7h
Original Estimate: Not Specified

Attachments: PNG File image-2022-02-18-10-23-25-193.png     Text File stacktrace.txt    
Issue Links:
Problem/Incident
dependency
is depended upon by MGNLUI-6247 Make the LocaleSelectionSupport exten... Closed
documentation
to be documented by MGNLUI-7061 DOC: Update 'pageLength' for combobox... Closed
duplicate
is duplicated by MGNLUI-7020 comboBox cannot handle more than 500 ... Closed
relation
Template:
Acceptance criteria:
Empty
Task DoD:
[X]* Doc/release notes changes? Comment present?
[X]* Downstream builds green?
[X]* Solution information and context easily available?
[X]* Tests
[X]* FixVersion filled and not yet released
[ ]  Architecture Decision Record (ADR)
Bug DoR:
[X]* Steps to reproduce, expected, and actual results filled
[X]* Affected version filled
Release notes required:
Yes
Documentation update required:
Yes
Date of First Response:
Epic Link: Nucleus Quality Maintenance
Sprint: Nucleus 5, Nucleus 7
Story Points: 2
Team: Nucleus

 Description   

Steps to reproduce

  1. Setup an instance with more than 500 assets
  2. Create an Image component (which actually uses comboBoxField)
  3. Check that when clicking on "Select new" an error is throw

Expected results

All assets are displayed

Actual results

IllegalStateException is thrown (Client tried fetch more rows than allowed. This is denied to prevent denial of service.)

Workaround

Set the pageLength to 500 (or less) in the combobox definition Needs to be set to <=108 and scrollToSelectedItem=false for data sources with more than 500 items.

Notes

Prevent misconfiguration, provide def. app error.



 Comments   
Comment by Richard Gange [ 20/Jan/22 ]

IMO we have to have some global way to change the comboBox field max. Otherwise it could be a tedious issue of having to reconfigure a bunch of fields that were working before the limit was introduced.

Comment by Roman Kovařík [ 15/Feb/22 ]

Moving back to discovery, see https://git.magnolia-cms.com/projects/PLATFORM/repos/ui/pull-requests/1624/overview?commentId=92461.

Comment by Quach Hao Thien [ 18/Feb/22 ]

Discovery

Steps to reproduce

  1. Setup an dx-core-demo-webapp instance with more than 500 assets
    Prepare the assets by running the groovy script, which create over 1000 records to the dam /foo 
session = ctx.getJCRSession('dam')
session.getRootNode().addNode('foo', 'mgnl:folder')

folderNode = session.getNode('/foo')

for(int i in 1..1000) {
    println(i)
    folderNode.addNode(i as String, "mgnl:asset")
}

session.save() 
  1. Go to Resources app and modify the textImage.yaml dialog: mtk2/dialogs/components/textImage.yaml
form:
  properties:
    headlineLevel:
      $type: comboBoxField
      defaultValue: small
      datasource:
        $type: optionListDatasource
        options:
          - name: big
            value: big
          - name: medium
            value: medium
          - name: small
            value: small
    headline:
      $type: textField
      i18n: true
    text:
      class: info.magnolia.dam.app.field.DamRichTextFieldDefinition
      i18n: true
    image:
      $type: damLinkField
    imageComboBox:
      $type: comboBoxField
      datasource:
        $type: jcrDatasource
        workspace: dam
        rootPath: /foo
    imagePosition:
      $type: comboBoxField
      defaultValue: below
      datasource:
        $type: optionListDatasource
        options:
          - name: above
            value: above
          - name: below
            value: below
    imageAltText:
      $type: textField
      i18n: true
    imageTitle:
      $type: textField
      i18n: true
    imageCaption:
      $type: textField
      i18n: true
    imageCredit:
      $type: textField
      i18n: true
  layout:
    $type: tabbedLayout
    tabs:
      - name: tabText
        fields:
          - name: headlineLevel
          - name: headline
          - name: text
      - name: tabImage
        fields:
          - name: image
          - name: imageComboBox
          - name: imagePosition
          - name: imageAltText
          - name: imageTitle
          - name: imageCaption
          - name: imageCredit
  1. Go to Pages app and open a page (Travel home page), choose Main area,
  2. Add Text and image component, switch to Image tab and click on the dropdown button of imageComboBox field, observe the exception

Expected results

All assets are displayed

Actual results

IllegalStateException is thrown (Client tried fetch more rows than allowed. This is denied to prevent denial of service.)

Workaround

Set the pageLength to 500 (or less) in the combobox definition <- this doesn't fix the issue

Discovery notes

  1. Update steps to reproduce: script and screenshot
  2. This problem is the consequence of fixing for CVE https://vaadin.com/security/cve-2021-33609
    1. Vaadin 8.14.1 (we are here) - File changes https://github.com/vaadin/framework/pull/12415/files, for short, they limits the rows to 500 in DataCommunicator 
    2. Vaadin 8.14.3 - expose the API to config the maximum_allowed_row, e.g: select.getDataComunnicator().setMaximumAllowedRows(1000)
    3. Tried with solution change pageLength, the pageLength property doesn't reflect to, but somehow affect to the numberOfRows in DataCommunicator com.vaadin.data.provider.DataCommunicator#onRequestRows
      from Adam:

      something weird happening here.. works with pageLength parameter set in range 1-108. With 109 and higher it throws "IllegalStateException: Client tried fetch more rows than allowed. This is denied to prevent denial of service."

Development notes

  • limit pageLength to 108 (or 100 for better number) << work around solution
    • Cannot set this property exceed 108, since the mechanism of AbstractRemoteDatasource checking for the cache coverage com.vaadin.client.data.AbstractRemoteDataSource#checkCacheCoverage will send the request to server for data when it needs more rows (com.vaadin.client.data.AbstractRemoteDataSource#handleMissingRows)
    • The number of request rows is calculated by com.vaadin.client.data.CacheStrategy.AbstractBasicSymmetricalCacheStrategy#getMaxCacheRange
  • Warning user to using different field rather than combobox for big dynamic data size
Comment by Richard Gange [ 18/Feb/22 ]

BUILD-654: CLONE - Update to Vaadin 8.14.3

Comment by Roman Kovařík [ 14/Mar/22 ]

Solution:

  • the comboBox#pageLength default is changed to 100.
  • setting anything higher produces definitions app error and fallbacks to 100
  • this applies to TagsFieldDefinition as well as it uses the same comboBox definition
  • for the record, we haven't changed any vaadin's data communicator default limit to not expose denial of service
Comment by Roman Kovařík [ 23/Mar/22 ]

Reopened: we can still run into the issue if we set pageLength to 0.

Comment by Ashraf Khamis [ 31/Mar/22 ]

Doc update: https://git.magnolia-cms.com/projects/DOCUMENTATION/repos/product-docs/pull-requests/968/overview

Comment by Quach Hao Thien [ 31/Mar/22 ]

for RN:

  • Enable ComboBox's pagination by default to 100 (pageLength = 100) to prevent exception on fetching
  • The pagination will unable to disable and pageLength property must be in range of number from 1 to 100
Generated at Mon Feb 12 09:42:19 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.