Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle bad URI #572

Merged
merged 1 commit into from Apr 3, 2021
Merged

Handle bad URI #572

merged 1 commit into from Apr 3, 2021

Conversation

benblack86
Copy link
Contributor

I want to prevent bad data generated by a pen tester from causing a 500. For example, the following URL causes decodeURIComponent to throw a URI malformed error.

/accounts/%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afetc%c0%afpasswd

Instead I want to turn it into a BadRequest error. Does this seem good? Happy to add a test, but not sure where to put it?

Copy link
Owner

@cdimascio cdimascio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks. this looks good

@cdimascio cdimascio merged commit 42baee3 into cdimascio:master Apr 3, 2021
@cdimascio
Copy link
Owner

fixed in v4.12.7

@benblack86 benblack86 deleted the handle-bad-uri branch April 5, 2021 14:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants