Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new default exception to ignore for Rack::Utils::InvalidParameterError #535

Open
dmeranda opened this issue Jun 19, 2023 · 0 comments
Open

Comments

@dmeranda
Copy link

See also similar issue #506

Consider adding the Rack::Utils::InvalidParameterError exception to the built-in list of normally ignored exceptions.

That exception is raised whenever any of the request parameters has an invalid string encoding; such as an invalid UTF-8 byte sequence.

Although invalid strings won't normally be sent by web browsers, it can happen with malware or hacking attacks as a often-used attack vector; so when it does happen these errors can occur rapidly and in large numbers. Bad UTF-8 should probably just result in an HTTP 400 Bad Request response, and little else.

By the way, this UTF-8 checking and exception happens very early in the Rack stack in ActionDispatch::Request.check_param_encoding and can not normally be caught or handled by the Rails application itself, say by a rescue_from.

Steps to reproduce

Use curl, wget, or similar tool other than a web browser, and add an invalid UTF-8 sequence to the end of any application URL; like https://....../example?badstring=%E2%28%A1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant