[SHARING] Credentials including URL are raising an Exception and corrupt the vault (data loss)

Bug report

Trying to share login credentials including a url makes passman throwing an excepetion becauses of:

SQLSTATE[42000]: Syntax error or access violation: 1118 Row size too large (> 8126). Changing some columns to TEXT or BLOB or using ROW_FORMAT=DYNAMIC or ROW_FORMAT=COMPRESSED may help. In current row format, BLOB prefix of 768 bytes is stored inline.

Steps to reproduce

Bug is reproducible in the online demo (did it twice)

1. Create credentials with Label: test, Username: test, Password: test & URL: https://www.google.de
2. Try to share it with any user

Expected behaviour

User wich got selected for sharing the credentials with, should be able to use the credentials.

Actual behaviour

1. Vault gets corrupted if you dont delete the complete dataset instantly. If you try to reopen the vault its not gonna work.
2. Selected User gets request for accepting the share but its not gonna work because data is corrupted.

Configuration

Operating system: Windows 10, Fedora 26 (Client)

Browser: FireFox 58, latest Chrome (tried multiple Browsers)

Extensions that might cause interference: none

Passman version: 2.1.5

Operating system: Debian 9 (Server)

Web server: Apache 2.4.25

Database: MariaDB Ver 15.1 Distrib 10.1.26-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2

PHP version: PHP 7.0.19-1

cloud server: Nextcloud

cloud version: 12.0.3

Browser log

Cloud log

Doctrine\DBAL\Exception\DriverException: An exception occurred while executing 'UPDATE `oc_passman_credentials` SET `guid` = ?,`vault_id` = ?,`user_id` = ?,`label` = ?,`description` = ?,`created` = ?,`changed` = ?,`tags` = ?,`email` = ?,`username` = ?,`password` = ?,`url` = ?,`icon` = ?,`expire_time` = ?,`files` = ?,`custom_fields` = ?,`otp` = ?,`hidden` = ?,`delete_time` = ?,`shared_key` = ? WHERE `id` = ?' with params [DATA REMOVED]: SQLSTATE[42000]: Syntax error or access violation: 1118 Row size too large (> 8126). Changing some columns to TEXT or BLOB or using ROW_FORMAT=DYNAMIC or ROW_FORMAT=COMPRESSED may help. In current row format, BLOB prefix of 768 bytes is stored inline.

Maybe favicons should be stored in filesystem instead of database? Their size can vary very.

Thank you very much for making this very useful tool.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Start with the sharing flow named in share.js, credentialservice.js, shareservice.js, and crypto_wrap.js, then reproduce the URL-sharing steps while checking the cloud log. Inspect the oc_passman_credentials UPDATE and its database schema around the reported row-size error. Done means sharing credentials with a URL completes without an exception or vault corruption and the recipient can use them.