Change default for parseHuge to false to avoid OOM on xml expansion

[ceeram]

The option was added to allow for enabling (#10034) parseHuge as the docblock also decribes, having this enabled though by default is not recommended.

[codecov-io]

Codecov Report

Merging #11094 into master will increase coverage by 0.05%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##             master   #11094      +/-   ##
============================================
+ Coverage     94.87%   94.92%   +0.05%     
- Complexity    12838    13059     +221     
============================================
  Files           437      437              
  Lines         32732    33060     +328     
============================================
+ Hits          31053    31381     +328     
  Misses         1679     1679

Impacted Files	Coverage Δ	Complexity Δ
src/Utility/Xml.php	100% <ø> (ø)	73 <0> (ø)	⬇️
src/Http/ActionDispatcher.php	100% <0%> (ø)	21% <0%> (+2%)	⬆️
src/Controller/Controller.php	99.53% <0%> (+0.07%)	102% <0%> (+25%)	⬆️
src/Http/ServerRequest.php	99.65% <0%> (+0.16%)	432% <0%> (+194%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e64e0a9...e9fdee3. Read the comment docs.

[inoas]

Doesn't look BC to me, is it?

[ceeram]

Correct, in most cases people won't notice the changed default. The docblock already stated that you had to enable parseHuge, but the code defaulted to true. This default behavior is an insecure one, so it is now changed to false. 2017-08-28 3:42 GMT+02:00 inoas <notifications@github.com>:

…

Doesn't look BC to me, is it? — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#11094 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAGzWO00FzD21E7pKZ3DnBEG7bXAIt6jks5schrsgaJpZM4PCEZf> .

[ravage84]

@markstory This should be shown very prominently in the release notes, then. So pepole don't trip over it.

[ceeram]

I doubt if many users will trip. First off, Most users don't use Xml, those that do use it would only need parseHuge in edge cases. The docs already stated to set parseHuge option to true, even though the code itself didnt need it, because of the default. So most likely for those edge cases people are passing the parseHuge option as true already.

[ravage84]

@ceeram thanks for the clarification.