Files @ aa51aca7fd1a
Branch filter:

Location: kallithea/init.d/kallithea-daemon-redhat - annotation

Valentin Kleibel
controller: Handle UnicodeDecodeError from webob decoding invalid URLs

webob will try to utf-8 decode all %-encoded bytes in URL-parameters, but will
not handle Unicode erors ... and neither did Kallithea. Visiting a URL like
http://localhost:5000/?%AD would thus give an unhandled exception showing
"Internal Server Error" to the user, and logging the full traceback and:

WebApp Error: UnicodeDecodeError: 'utf-8' codec can't decode byte 0xad in position 0: invalid start byte

This has been seen a lot recently from attackers probing for a php
vulnerability
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ .

Now handle these exceptions more nicely and reject with "400 Bad Request".
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
24c0d584ba86
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
2c3d30095d5e
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
24c0d584ba86
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
2c3d30095d5e
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
2c3d30095d5e
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
71bdbf129190
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
24c0d584ba86
99ad9d0af1a3
24c0d584ba86
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
99ad9d0af1a3
e285bb7abb28
#!/bin/sh
########################################
#### THIS IS A REDHAT INIT.D SCRIPT ####
########################################

##################################################
#
# Kallithea server startup script
# Recommended default-startup: 2 3 4 5
# Recommended default-stop: 0 1 6
#
##################################################


APP_NAME="kallithea"
# the location of your app
# since this is a web app, it should go in /var/www
APP_PATH="/var/www/$APP_NAME"

CONF_NAME="production.ini"

# write to wherever the PID should be stored, just ensure
# that the user you run gearbox as has the appropriate permissions
# same goes for the log file
PID_PATH="/var/run/kallithea/pid"
LOG_PATH="/var/log/kallithea/kallithea.log"

# replace this with the path to the virtual environment you
# made for Kallithea
PYTHON_PATH="/opt/python_virtualenvironments/kallithea-venv"

RUN_AS="kallithea"

DAEMON="$PYTHON_PATH/bin/gearbox"

DAEMON_OPTS="serve --daemon \
    --user=$RUN_AS \
    --group=$RUN_AS \
    --pid-file=$PID_PATH \
    --log-file=$LOG_PATH -c $APP_PATH/$CONF_NAME"

DESC="kallithea-server"
LOCK_FILE="/var/lock/subsys/$APP_NAME"

# source CentOS init functions
. /etc/init.d/functions

RETVAL=0

remove_pid () {
  rm -f ${PID_PATH}
  rmdir `dirname ${PID_PATH}`
}

ensure_pid_dir () {
  PID_DIR=`dirname ${PID_PATH}`
  if [ ! -d ${PID_DIR} ] ; then
    mkdir -p ${PID_DIR}
    chown -R ${RUN_AS}:${RUN_AS} ${PID_DIR}
    chmod 755 ${PID_DIR}
  fi
}

start_kallithea () {
    ensure_pid_dir
    daemon --pidfile $PID_PATH \
        --user $RUN_AS "$DAEMON $DAEMON_OPTS"
    RETVAL=$?
    [ $RETVAL -eq 0 ] && touch $LOCK_FILE
    return $RETVAL
}

stop_kallithea () {
    if [ -e $LOCK_FILE ]; then
      killproc -p $PID_PATH
      RETVAL=$?
      rm -f $LOCK_FILE
      rm -f $PID_PATH
    else
      RETVAL=1
    fi
    return $RETVAL
}

status_kallithea() {
  if [ -e $LOCK_FILE ]; then
    # exit with non-zero to indicate failure
    RETVAL=1
  else
    RETVAL=0
  fi
  return $RETVAL
}

restart_kallithea () {
    stop_kallithea
    start_kallithea
    RETVAL=$?
}

case "$1" in
  start)
    echo -n $"Starting $DESC: "
    start_kallithea
    echo
    ;;
  stop)
    echo -n $"Stopping $DESC: "
    stop_kallithea
    echo
    ;;
  status)
    status_kallithea
    RETVAL=$?
    if [ ! $RETVAL -eq 0 ]; then
      echo "Kallithea server is running..."
    else
      echo "Kallithea server is stopped."
    fi
    ;;
  restart)
    echo -n $"Restarting $DESC: "
    restart_kallithea
    echo
    ;;
  *)
    echo $"Usage: $0 {start|stop|restart|status}"
    RETVAL=1
    ;;
esac

exit $RETVAL