[PATCH 0 of 1] Bad input handling: discussion

[Andrew Shadura]

Hello,

On Thu, 26 Feb 2015 21:06:36 +0100
Thomas De Schampheleire
<patrickdepinguin at gmail.com> wrote:

> I don't think Kallithea should crash or present 500 in cases where an
> input is not what we expect.
> In any case, '400 bad request' is better than '500 server error', as
> also said by Mads in [1].
> 
> Whether or not we should ignore invalid input: my initial thought was
> that it is good idea. However, from the link Mads provided in [1], it
> seems there can be security issues with such behavior, in general. So
> I'm not sure anymore what to do here, I'm not very familiar with this
> area.
> 
> What could be the reason for such invalid input, other than malicious
> attempts?

In this situation (I found "WS%3" in the real logs) this might be
misinterpretation of some links by search engine bots or something like
that. I'm not sure how failing on such input is better or worse than
ignoring it.

-- 
Cheers,
  Andrew