kallithea Files · docs/index.rst

Files @ aa51aca7fd1a

Branch filter:

Location: kallithea/docs/index.rst

aa51aca7fd1a 1.2 KiB text/prs.fallenstein.rst Show Annotation Show as Raw Download as Raw

Valentin Kleibel

controller: Handle UnicodeDecodeError from webob decoding invalid URLs

webob will try to utf-8 decode all %-encoded bytes in URL-parameters, but will
not handle Unicode erors ... and neither did Kallithea. Visiting a URL like
http://localhost:5000/?%AD would thus give an unhandled exception showing
"Internal Server Error" to the user, and logging the full traceback and:

WebApp Error: UnicodeDecodeError: 'utf-8' codec can't decode byte 0xad in position 0: invalid start byte

This has been seen a lot recently from attackers probing for a php
vulnerability
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ .

Now handle these exceptions more nicely and reject with "400 Bad Request".

.. _index:

#######################
Kallithea Documentation
#######################

* :ref:`genindex`
* :ref:`search`


Readme
******

.. toctree::
   :maxdepth: 1

   readme


Administrator guide
*******************

**Installation and upgrade**

.. toctree::
   :maxdepth: 1

   overview
   installation
   installation_win
   installation_win_old
   installation_iis
   installation_puppet
   upgrade

**Setup and configuration**

.. toctree::
   :maxdepth: 1

   setup
   administrator_guide/auth
   administrator_guide/vcs_setup
   usage/email
   usage/customization

**Maintenance**

.. toctree::
   :maxdepth: 1

   usage/backup
   usage/performance
   usage/debugging
   usage/troubleshooting


User guide
**********

.. toctree::
   :maxdepth: 1

   usage/general
   usage/vcs_notes
   usage/statistics
   api/api


Developer guide
***************

.. toctree::
   :maxdepth: 1

   contributing
   dev/i18n
   dev/dbmigrations


.. _python: http://www.python.org/
.. _django: http://www.djangoproject.com/
.. _mercurial: https://www.mercurial-scm.org/
.. _git: http://git-scm.com/
.. _celery: http://celeryproject.org/
.. _Sphinx: http://sphinx.pocoo.org/
.. _vcs: http://pypi.python.org/pypi/vcs