Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LanguageFactoryImpl throws NumberFormatException if user sends invalid data #8305

Closed
dim-s opened this issue Nov 2, 2015 · 1 comment
Closed

Comments

@dim-s
Copy link

dim-s commented Nov 2, 2015

We found incorrect behaviour in Language System. If an user has some incorrect data in cookies, dotcms writes to logs the NumberFormat exception like this:

ERROR com.dotmarketing.portlets.languagesmanager.business.LanguageFactoryImpl - getLanguage failed passed id is not numeric.
 java.lang.NumberFormatException:
For input string: "if(now()=sysdate(),sleep(26),0)/*'XOR(if(now()=sysdate(),sleep(26),0))OR'"XOR(if(now()=sysdate(),sleep(26),0))OR"*/"
03:26:43,237 INFO  [stdout] (Log4J Active Asynchronous Appender)        at java.lang.NumberFormatException.forInputString(NumberFormatException.java:65)
03:26:43,237 INFO  [stdout] (Log4J Active Asynchronous Appender)        at java.lang.Long.parseLong(Long.java:441)
03:26:43,238 INFO  [stdout] (Log4J Active Asynchronous Appender)        at java.lang.Long.parseLong(Long.java:483)

Our case:
Someone tried to break our site through a large number of incorrect requests with invalid language id.
And as a result our log began to weigh 21 gigabytes and disk space is over.

Maybe the best solution is not to write this information to logs?

@stale
Copy link

stale bot commented Sep 30, 2019

This issue has been automatically marked as stale because it has not had activity within the past 90 days. It will be closed in 30 days no further activity occurs. Thank you.

@stale stale bot added the wontfix label Sep 30, 2019
@stale stale bot closed this as completed Oct 30, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant