Hello, On Thu, 26 Feb 2015 21:06:36 +0100 Thomas De Schampheleire <[email protected]> wrote:
> I don't think Kallithea should crash or present 500 in cases where an > input is not what we expect. > In any case, '400 bad request' is better than '500 server error', as > also said by Mads in [1]. > > Whether or not we should ignore invalid input: my initial thought was > that it is good idea. However, from the link Mads provided in [1], it > seems there can be security issues with such behavior, in general. So > I'm not sure anymore what to do here, I'm not very familiar with this > area. > > What could be the reason for such invalid input, other than malicious > attempts? In this situation (I found "WS%3" in the real logs) this might be misinterpretation of some links by search engine bots or something like that. I'm not sure how failing on such input is better or worse than ignoring it. -- Cheers, Andrew _______________________________________________ kallithea-general mailing list [email protected] http://lists.sfconservancy.org/mailman/listinfo/kallithea-general
