600377 - dm-sheriff DOS Date parsing error

Status: RESOLVED WONTFIX

(Webtools Graveyard :: Sheriff Calendar, defect)

Description

[David Chan [:dchan]]

The dm-sheriff site crashes when invalid date values are passed in the URL. An ArgumentError is thrown and a RoR error page displayed.

STR
1. Visit https://dm-sheriff01.mozilla.org/?today="&from="&to="
2. You will get an error page

Code
http://github.com/kourge/sheriff/blob/master/app.rb#L23

Date.parse() is called on user supplied data in lines 23/24 . The resulting exception is not caught resulting in application crash.


Suggested fix
Catch the ArgumentError exception and log that malicious input was encountered

Comment 1

[David Chan [:dchan]]

The server appears to go down while testing and comes back up eventually. During this time, my session is invalid and I can't log back in.

Does the application automatically restart after a given amount of time?

Comment 2

[David Chan [:dchan]]

The application appears to have crashed after inputting a negative value on the preferences page for
'Email me about my upcoming sheriff duties X days in advance'