search

D4-project / BGP-Ranking

BGP ranking is a free software to calculate the security ranking of Internet Service Provider (ASN)
http://bgpranking.circl.lu/
GNU Affero General Public License v3.0
69 stars 6 forks source link

Lookup per invalid IP address gives Internal Server Error #9

Open btlogy opened 5 years ago

btlogy commented 5 years ago

Likely introduced by #1, query sent with invalid or empty IP gives a 500:

$ curl -vvv 'https://bgpranking.circl.lu/ipasn' -d 'ip='
...
> POST /ipasn HTTP/1.1
> Host: bgpranking.circl.lu
> User-Agent: curl/x.x.x
> Accept: */*
> Content-Length: 3
> Content-Type: application/x-www-form-urlencoded
> 
* upload completely sent off: 3 out of 3 bytes
< HTTP/1.1 500 INTERNAL SERVER ERROR
< Date: Wed, 29 May 2019 18:30:38 GMT
< Server: gunicorn/x.x.x
< Strict-Transport-Security: max-age=15768000
< Content-Type: text/html
< Content-Length: 290
< Connection: close
< 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>500 Internal Server Error</title>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.</p>
...
btlogy commented 5 years ago

I guess it lacks a validation here

Rafiot commented 5 years ago

It should be handled here: https://github.com/D4-project/IPASN-History/blob/master/client/pyipasnhistory/api.py#L102

adulau commented 5 years ago

Indeed, if the value is not an IP (any string), you'll get back a 500.

Rafiot commented 5 years ago

(.... and moving it back to here because the webserver doesn't return anything anymore and I don't have time to fix it rn)