On 02/26/2015 09:40 PM, Andrew Shadura wrote:
Hello,
On Thu, 26 Feb 2015 21:06:36 +0100
Thomas De Schampheleire
<[email protected]> wrote:
I don't think Kallithea should crash or present 500 in cases where an
input is not what we expect.
In any case, '400 bad request' is better than '500 server error', as
also said by Mads in [1].
Whether or not we should ignore invalid input: my initial thought was
that it is good idea. However, from the link Mads provided in [1], it
seems there can be security issues with such behavior, in general. So
I'm not sure anymore what to do here, I'm not very familiar with this
area.
What could be the reason for such invalid input, other than malicious
attempts?
In this situation (I found "WS%3" in the real logs) this might be
misinterpretation of some links by search engine bots or something like
that. I'm not sure how failing on such input is better or worse than
ignoring it.
Yes, that is where I prefer "garbage in - garbage out". We could try to
behave "nicely" when we get "garbage in", but there is really no correct
response to "garbage in". I prefer to make it clear that we can't
respond correctly instead of "cheating" and trying to guess what the
intention was ... and thus making the user believe the output is
reliable when it isn't.
/Mads
_______________________________________________
kallithea-general mailing list
[email protected]
http://lists.sfconservancy.org/mailman/listinfo/kallithea-general
