675978 - Internal Server Error 500 - Web_Service 0 while retrieving [...] which was HTTP status 404

Status: VERIFIED FIXED

(Socorro :: General, task)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Not sure if this is a duplicate or what, but:

https://crash-stats-dev.allizom.org/query/query?query_type=http://example.com/%3f%0D%0Ans:%20netsparker056650=vuln&do_query=1&query=Find+Crash+ID+or+Signature throws the following exception, I'm told:

2011-08-02 09:27:13 -07:00 --- Web_Service 0 while retrieving http://socorro-api-dev-internal/bpapi/201105/search/signatures/product/Firefox/build/3/in/signature/search_mode/contains/for/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%00.php/crash_reason/3/to/2011-08-02+09%3A00%3A04/from/2011-07-26+09%3A00%3A04/report_type/hang/report_process/plugin/result_number/100/ which was HTTP status 404

(I hope that's the right one -- wish we could get these exceptions in an easier-to-digest/access format.)

Comment 1

[Robert Helmer [:rhelmer]]

(In reply to comment #0)
> Not sure if this is a duplicate or what, but:
> 
> https://crash-stats-dev.allizom.org/query/query?query_type=http://example.
> com/%3f%0D%0Ans:
> %20netsparker056650=vuln&do_query=1&query=Find+Crash+ID+or+Signature throws
> the following exception, I'm told:
> 
> 2011-08-02 09:27:13 -07:00 --- Web_Service 0 while retrieving
> http://socorro-api-dev-internal/bpapi/201105/search/signatures/product/
> Firefox/build/3/in/signature/search_mode/contains/for/..%252F..%252F..%252F..
> %252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%00.php/
> crash_reason/3/to/2011-08-02+09%3A00%3A04/from/2011-07-26+09%3A00%3A04/
> report_type/hang/report_process/plugin/result_number/100/ which was HTTP
> status 404
> 
> (I hope that's the right one -- wish we could get these exceptions in an
> easier-to-digest/access format.)

The problem is that Apache will override everything and return a 404 if an encoded "/" is passed (this is a common attack technique), and we run middleware (socorro-api-internal) under mod_wsgi/apache.

Here's the error from Apache's log:

[Tue Aug 02 10:02:00 2011] [info] [client 10.2.74.61] found %2f (encoded '/') in URI (decoded='/bpapi/201005/adu/byday/p/Firefox/v/6.0a2;5.01;7.0a1/rt/hang/os/Linux/start/http://www.netsparker.com?/end/2011-08-01'), returning 404

If anything I think we should just make the frontend handle 404s (perhaps by returning a 404 itself).

Comment 2

[Lonnen :lonnen]

No longer 500's. 400 bad request, instead.

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

We now do indeed throw a 400:

[10:52:52.815] GET https://crash-stats.allizom.org/query/?query_type=http://example.com/%3f%0D%0Ans:%20netsparker056650=vuln&do_query=1&query=Find+Crash+ID+or+Signature [HTTP/1.1 400 BAD REQUEST 1193ms]