-2

I have a Rails app which is throwing exceptions when I get some strange urls with lots of garbage characters. For example

https://example.com/pages/28-faq-common-questions-answered++++++++++++++++++++++++Result:+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8

I definitely want to get rid of these Rails exceptions. These queries are never generated by a genuine user.

I was thinking of using RedirectMatch in Apache and just permanently redirect these types of queries to the site's home page.

Question 1: Is that a good idea or is there anything better?

Question 2: How to create rules to do this successfully with enough flexibility so I don't have to write many rules every time a new robot hits my site?

My crude attempt was the following but nothing happens. It doesn't seem to be working at all.

 RedirectMatch permanent /\+\+\+\+\+/g https://example.com
Improve this question
2
  • 1
    Related: Should I be concerned if my website throws stack information? on Information Security.
    – user
    Mar 26, 2015 at 9:33
  • 4
    Trying to "fix" this problem with rewrite rules is a terrible idea. Chances are you'd end up blocking legitimate requests while simultaneously still allow some bad requests to go through. You'd be trying to cover up a bug rather than fixing it, and the bug would still exist and possibly be a security vulnerability. Also you should accept the great answer by Michael.
    – kasperd
    Mar 26, 2015 at 10:49

2 Answers 2

Reset to default
5

Question 1: Is that a good idea or is there anything better?

Question 2: How to create rules to do this successfully with enough flexibility so I don't have to write many rules every time a new robot hits my site?

The better fix, which also coincidentally solves #2 as well, is to fix your application such that it does not throw exceptions when it gets hit by invalid requests. Instead, it should check any necessary preconditions on the input and gracefully bail out in case there is something wrong with the input, logging any pertient details and displaying a friendly error message to the user.

If for some reason the application cannot easily be modified to do this, consider at the very least wrapping it in an outer container that can catch exceptions, log details of them, and present the user with a friendly error message that does not include the exception details. That wouldn't solve the underlying problem, but it would at least prevent the user from being inconvenienced by a stack trace.

The problem of applications throwing exceptions exposing stack information was also discussed recently on our sister site Information Security in the question Should I be concerned if my website throws stack information?. The currently highest-voted (by far) answer to that question starts out by stating:

On production (contrary to development) environments, stack traces and error messages should be logged to file instead of dumped on screen. This is because an attacker may learn things about your system that could help compromise your system.

If you fix the application to work in such a manner, you also won't need the redirect rules at all.

Improve this answer
2
  • Thanks for the good answer Michael. I did adapt my setup according to your suggestions even though an assumption of yours was not right. When my app throws an exception it does NOT expose the stack to the outside world. Furthermore, I do address most exceptions as you suggest. I just thought I would add an external line of defense for this particular case. Thanks for your guidance.
    – allesklar
    Mar 31, 2015 at 8:18
  • @allesklar I did not assume that the exceptions were being exposed to the outside world. The question stated that when given invalid input, the application would crash with an exception and stack trace. By fixing the application such that it does not crash with an exception and stack trace when invoked inappropriately, you remove the problem entirely. Note the difference between my answer, and the paragraph I quoted from another answer.
    – user
    Mar 31, 2015 at 8:49
-3

You would use mod_rewrite with this kind of rule : RewriteRule \+\+\+\+\+ [F]

You'll then return a Forbidden error code to client, which will prevent server from executing more useless (in the context of useless request) code.

Improve this answer
5
  • 6
    While this solves the very limited problem of this exact request, it's the security equivalent of putting duct tape on a cracking foundation. It does not fix the problem with the application, and it will work only against requests matching this particular regexp.
    – Jenny D
    Mar 26, 2015 at 9:55
  • 1
    I can only give one upvote to @JennyD's comment, so I will further reiterate - this is not a good design or security decision.
    – BE77Y
    Mar 26, 2015 at 10:00
  • 1
    @BE77Y There exists an answer on the question which addresses that. ;-) </shameless plug>
    – user
    Mar 26, 2015 at 10:02
  • As @allesklar is not giving informations about the Rails routing and the kind of exceptions, we can't help him solve this at the Rails level.
    – Benjamin MALYNOVYTCH
    Mar 26, 2015 at 13:24
  • I agree with Benjamin. I did mark Michael's reply as the right one but Benjamin did answer my question well. Thanks to all.
    – allesklar
    Mar 31, 2015 at 8:15

Not the answer you're looking for? Browse other questions tagged .