Database Error: Data too long for column 'url' at row 1

[sbulen]

Description

Guest user. Logging.php line 128

Not frequent - I've seen it in my production log only once, ever...

We should probably substring to make the insert safe - not sure we need THAT much URL...

Environment (complete as necessary)

• Version/Git revision: Current GH
• Database Type: MySQL
• Database Version: 5.6
• PHP Version: 7.4

Additional information/references

Backtrace:

[sbulen]

Someone else with a similar issue - the URL in log_online is getting truncated:
https://www.simplemachines.org/community/index.php?topic=584065.0

I think my mysql 8 db won't let me store the value that's too long. I think that mysql 5.7 db is storing it, but truncating it.

Root cause is the same - a string that is too long for url in log_online

[jdarwood007]

I've seen this as well. Malformed url thats being logged? So we either cleanup the url or store more url in the table. For 2.1, since we don't want to do db changes, seems like truncating is a better option, but a future change should be toe extend the column

[sbulen]

It's building a large array, that includes the entire $_GET array + things like the USER_AGENT string, JSON encoding it, and putting it in there... Depending on your env, it fails on insert (data too long) or retrieval (malformed json, since the json string was truncated).

It already does some error checking and loads '' if there are any issues. It should probably just load '' if the string is too long, too.

Needs more research, but I think this info is only used as helpful context during error reporting, & also helps with the Who's Online page...

[jdarwood007]

When you see these, does the user agent get repeated multiple times? I'm seeing these and the user agent is repeated dozens of times. Seems like a infinite loop occurring?

[sbulen]

I haven't caught one in the wild yet.

Given the contents are truly variable length, a length check would be appropriate.

My bet is that some folks are dorking around with the useragent.....

Or... Are dumping very long strings in fields, and blowing out the size of $_GET

[jdarwood007]

I'm not sure, it looked repeating. I cleared the error log and didn't save one.

[jdarwood007]

Your correct, it is user agent manipulation. Lets truncate the user agent to 255 characters and I think that will do us.

I sent you some logs to show you what I see.

[sbulen]

Yep.

I would truncate user agent.

And for added safety, if whole string > field length (2048?) after encoding set it to ''.

Folks can also mess with $_get by entering long fields.