Redirecting requests that would result in an HTTP 400 (Bad Request) error (Apache 2.2)

Question

Due to a security vulnerability in Wordpress, a bunch of my posts got renamed to something like:

http://**MYSITE**/2008/08/21/**POSTNAME**/%&%28%7B$%7Beval%28base64_decode%28$_SERVER%5BHTTP_EXECCODE%5D%29%29%7D%7D%7C.+%29&%/

I've since fixed the problem, upgraded Wordpress, and also upgraded my Web server to Apache 2.2.3. The problem is, now I have a bunch of URLs that are indexed in Google and linked to from other sites. Google will eventually remove them from their index, but in the meantime I want to rewrite the bad URLs to correct URLs.

I've tried the following mod_rewrite rule, but it doesn't seem to work. It seems like Apache is seeing the request as "bad" and just returning an HTTP 400 error without ever consulting mod_rewrite (or mod_redirect). Here's the rule I've tried:

RewriteRule ^(20[0-9]{2}/[0-1][0-9]/[0-3][0-9]/[^/]+)/.*base64.*$ http://***MYSITE***/$1 [L,R=302,QSA]

Which matches when I test it in a regular expression tool, but doesn't seem to make any difference to Apache. Has anyone come across this problem? Any possible solution?

Thanks!

Chris

Answer 1

You could define a custom ErrorDocument for the 400 Errors like so:

ErrorDocument 400 /cgi-bin/handle400.cgi

and then have that cgi (or php or servlet or whatever) do the header rewriting and location redirecting.

EDIT: because of Jacek's answer I just tested above solution to confirm it works on Apache 2.2.

My Server Config:

ScriptAlias     /cgi-bin/ "/var/www/cgi-bin/"
ErrorDocument   400 /cgi-bin/handle400.pl

lukas$ cat /var/www/cgi-bin/handle400.pl

#!/usr/bin/perl
print "Content-type: text/html\n\n";
while (my ($key, $val) = each %ENV) {
        print "$key = $val<BR>\n";
}
exit 0;

Now when accessing the broken URL that would produce an error 400 Bad Request before, I now get the following (partial) output:

...
REDIRECT_REQUEST_METHOD = GET
REDIRECT_STATUS = 400
REMOTE_ADDR = xx.xx.xx.xx
REQUEST_URI = /%&%28%7B$%7Beval%28base64_decode%28$_SERVER%5BHTTP_EXECCODE%5D%29%29%7D%7D%7C.+%29&%/
GATEWAY_INTERFACE = CGI/1.1
SCRIPT_URL = /cgi-bin/handle400.pl
...

So you do get enough information to do a proper status code change and location redirect.

Answer 2

'400 Bad request' means the request is so broken it cannot be parsed/understood by the server. That means the server has no data from the request (even the URL), so there is nothing mod_rewrite, or any other tool handling request data, can do about it.