Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't crash when attempting to decode an invalid URL #19

Merged
merged 2 commits into from
Nov 7, 2014

Conversation

f0rk
Copy link
Contributor

@f0rk f0rk commented Nov 7, 2014

2014-10-29 16:15:54,681 could not decode url: 'http://www.test.com/\xc0.\xc0./\xc0.\xc0./\xc0.\xc0./\xc0.\xc0./windows/win.ini'
Traceback (most recent call last):
 File "/usr/lib/python2.7/dist-packages/pyramid_exclog/__init__.py", line 111, in exclog_tween
   return handler(request)
 File "/usr/lib/python2.7/dist-packages/pyramid_tm/__init__.py", line 82, in tm_tween
   reraise(*exc_info)
 File "/usr/lib/python2.7/dist-packages/pyramid_tm/__init__.py", line 62, in tm_tween
   t.note(request.path_info)
 File "/usr/lib/python2.7/dist-packages/webob/descriptors.py", line 68, in fget
   return req.encget(key, encattr=encattr)
 File "/usr/lib/python2.7/dist-packages/webob/request.py", line 178, in encget
   return val.decode(encoding)
 File "/usr/lib/python2.7/encodings/utf_8.py", line 16, in decode
   return codecs.utf_8_decode(input, errors, True)
UnicodeDecodeError: 'utf8' codec can't decode byte 0xc0 in position 1: invalid start byte

Discovered with the help of Nessus.

@mmerickel
Copy link
Member

Good find. Can you please submit a test for this to maintain 100% coverage?

@f0rk
Copy link
Contributor Author

f0rk commented Nov 7, 2014

How? The use of fake requests and dummy transactions makes that a bit difficult. Obviously I can raise an exception in the appropriate place but there's so much mocked out it's not like it reflects reality.

@mmerickel
Copy link
Member

The test is to see how pyramid_tm handles an un-decodable path_info. Simply make a dummy request that raises on the path_info property to provide a justification for that code path existing.

@f0rk
Copy link
Contributor Author

f0rk commented Nov 7, 2014

Tests added

mmerickel added a commit that referenced this pull request Nov 7, 2014
Don't crash when attempting to decode an invalid URL
@mmerickel mmerickel merged commit dd61462 into Pylons:master Nov 7, 2014
@mmerickel
Copy link
Member

Looks great, thank you very much.

@tseaver
Copy link
Member

tseaver commented Nov 8, 2014

Hmm, looks like we don't have Travis running on PRs. This change broke tests on Py3k: I've pushed a change which fixes it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants