Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bad path info triggers UnicodeDecodeError #1249

Closed
davisagli opened this issue Jan 28, 2025 · 2 comments
Closed

Bad path info triggers UnicodeDecodeError #1249

davisagli opened this issue Jan 28, 2025 · 2 comments

Comments

@davisagli
Copy link
Member

We got some errors from a bot trying bogus path info with characters that can't be decoded as utf-8.

Version: Zope 5.11.1
Request Path: /../../../../../../../../windows/win.ini%C0%80.jsp
Traceback:

Traceback (most recent call last):
  File "/app/lib/python3.11/site-packages/opentelemetry/trace/__init__.py", line 589, in use_span
    yield span
  File "/app/lib/python3.11/site-packages/opentelemetry/instrumentation/wsgi/__init__.py", line 672, in __call__
    iterable = self.wsgi(environ, start_response)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/lib/python3.11/site-packages/collective/opentelemetry/profiler.py", line 18, in profiler_middleware
    return app(environ, start_response)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/lib/python3.11/site-packages/paste/translogger.py", line 76, in __call__
    return self.application(environ, replacement_start_response)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/lib/python3.11/site-packages/ZPublisher/WSGIPublisher.py", line 349, in publish_module
    path_info = path_info.decode('utf-8')
                ^^^^^^^^^^^^^^^^^^^^^^^^^
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xc0 in position 131: invalid start byte

I would expect that Zope should return a 400 response and not log the exception.

@dataflake
Copy link
Member

See #1247 which was released as part of Zope 5.12.

@davisagli
Copy link
Member Author

@dataflake Ah sorry, I should have checked that before adding this issue. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants