No Limit on Cache Size

[tehryanx]

Using data-turbo-preload, it's possible to overload the cache and make the browser unstable. This turns a simple link injection bug into a full browser DOS. Below are screenshots where I've loaded a 30mb and a 50mb file into cache using nothing but a link tag. Note how the memory footprint balloons.

Providing a configuration option to limit the size of the cache could mitigate this.

[seanpdoyle]

@tehryanx thank you for opening this issue!

I'm surprised that this is possible. The SnapshotClass has had a size property since the project was ported from Turbolinks. Calls to put and get on that call invoke touch(), which them invokes trim().

Recently, the original implementation has been split into a new MemoryStore cache, which still accepts a size, and has a default size of 10 entries.

@afcapel @kevinmcconnell since you two have recently implemented the new caching mechanisms, this is definitely worth investigating further.

[afcapel]

@seanpdoyle I don't think this issue is related to the disk cache additions, since it predates the PR being merged.

The normal Turbo cache is an in memory cache, so preloading a very big page will load it into memory. That's the expected behaviour. You can fix this removing the preloading or opting out of caching.

Agreed that now that we have a disk cache it'd be interesting to explore if we can limit the cache byte size, instead of limiting the number entries, but I suspect it will be a bit difficult to nail down in a general way.

[seanpdoyle]

@afcapel that makes a lot of sense.

I don't think this issue is related to the disk cache additions

I'm sorry, I didn't mean to imply that you had introduced it, only that your fresh context on that area of the codebase might help to inform a solution.