SugarBean->cleanBean performance issue #4181

New issue

Open

opened 2026-02-20 16:14:37 -05:00 by deekerman · 2 comments

deekerman commented

2026-02-20 16:14:37 -05:00

Owner

Originally created by @PedroErnst on GitHub (Dec 31, 2019).

The cleanBean function has a negative impact on performance.

Issue

Inside the bean save function cleanBean() is called to remove potentially malicious code. This function will call SugarCleaner::cleanHtml() on every text, html or varchar field on the bean.
The problem lies in that this function creates a new HtmlSanitizer object each time, and the constructor of HtmlSanitizer is badly bloated, executing a lot of things which would probably only need to run once per page load, not dozens of times per save operation.

On some test on my local cleanBean() was taking as much as 80% of the total time spent in the save() function.

Now this would hardly be noticeable in many of the regular CRM interactions, loading a page, a listview, detailview, saving a single record... etc, but there's a few functionalities where it really tanks performance: Importer and Mass Update.

The HtmlSanitizer constructor can probably be refactored to do less things, or converted into a singleton class to avoid being instantiated every time.

Expected Behavior

cleanBean() should be fast, it's essentially string processing.

Actual Behavior

cleanBean() takes an unreasonable amount of time to run.

Possible Fix

Refactor HtmlSanitizer to be singleton class, or make the constructor leaner.

Steps to Reproduce

Profile SugarBean->save()

Your Environment

SuiteCRM Version used: SuiteAssured 2.0.5, SuiteCRM 7.10.22
Browser name and version (e.g. Chrome Version 51.0.2704.63 (64-bit)): Any
Environment name and version (e.g. MySQL, PHP 7): Any
Operating System and version (e.g Ubuntu 16.04): Any

Originally created by @PedroErnst on GitHub (Dec 31, 2019).    The `cleanBean` function has a negative impact on performance. #### Issue   Inside the bean save function `cleanBean()` is called to remove potentially malicious code. This function will call `SugarCleaner::cleanHtml()` on every text, html or varchar field on the bean. The problem lies in that this function creates a new `HtmlSanitizer` object each time, and the constructor of `HtmlSanitizer` is badly bloated, executing a lot of things which would probably only need to run once per page load, not dozens of times per save operation. On some test on my local `cleanBean()` was taking as much as 80% of the total time spent in the `save()` function. Now this would hardly be noticeable in many of the regular CRM interactions, loading a page, a listview, detailview, saving a single record... etc, but there's a few functionalities where it really tanks performance: Importer and Mass Update. The `HtmlSanitizer` constructor can probably be refactored to do less things, or converted into a singleton class to avoid being instantiated every time. #### Expected Behavior  `cleanBean()` should be **fast**, it's essentially string processing. #### Actual Behavior   `cleanBean()` takes an unreasonable amount of time to run. #### Possible Fix  Refactor `HtmlSanitizer` to be singleton class, or make the constructor leaner. #### Steps to Reproduce   1. Profile `SugarBean->save()` #### Your Environment  * SuiteCRM Version used: SuiteAssured 2.0.5, SuiteCRM 7.10.22 * Browser name and version (e.g. Chrome Version 51.0.2704.63 (64-bit)): Any * Environment name and version (e.g. MySQL, PHP 7): Any * Operating System and version (e.g Ubuntu 16.04): Any

deekerman added the

Type: Bug

Status:Fix Proposed

Priority:Important

Area: Clean Up: Performance

labels

2026-02-20 16:14:37 -05:00

deekerman commented

2026-02-20 16:14:38 -05:00

Author

Owner

@Jason-Dang commented on GitHub (Dec 31, 2019):

This should probably be higher priority as performance should be critical IMO.

@Jason-Dang commented on GitHub (Dec 31, 2019): This should probably be higher priority as performance should be critical IMO.

deekerman commented

2026-02-20 16:14:38 -05:00

Author

Owner

@Dillon-Brown commented on GitHub (Dec 31, 2019):

@Jason-Dang I'm thinking we probably need a label specifically for performance, I also didn't like giving this one just "Clean-Up" and "Low Priority".

In terms of the priority labels though, the performance would need to be bad enough that it's timing out / unusable to be worth marking higher. At the moment we have roughly 15 high priority blockers with limited or no-workaround that need to be tackled first before we can even start thinking about performance bugs imo.

@Dillon-Brown commented on GitHub (Dec 31, 2019): @Jason-Dang I'm thinking we probably need a label specifically for performance, I also didn't like giving this one just "Clean-Up" and "Low Priority". In terms of the priority labels though, the performance would need to be bad enough that it's timing out / unusable to be worth marking higher. At the moment we have roughly [15](https://github.com/salesagility/SuiteCRM/issues?q=is%3Aopen+is%3Aissue+label%3A%22High+Priority%22) high priority blockers with limited or no-workaround that need to be tackled first before we can even start thinking about performance bugs imo.