alphagov / government-frontend

Serves government pages on GOV.UK
https://docs.publishing.service.gov.uk/apps/government-frontend.html
MIT License
54 stars 17 forks source link

Handle incorrectly UTF-8 encoded query and cookie url (alternative approach) #3389

Closed unoduetre closed 1 month ago

unoduetre commented 1 month ago

⚠️ This repo is Continuously Deployed: make sure you follow the guidance ⚠️

Follow these steps if you are doing a Rails upgrade.

What

Stop sentry alerting on the “invalid byte sequence in UTF-8 errors”.

As discussed with @hannako, we will use a a solution based on an external gem called rack-utf8_sanitizer instead of developing our own gem. This solution will then be used in all our apps by copy-pasting the configuration of this gem.

This PR presentes an alternative approach to resolving this issue. The errors will not go through the normal Rails middleware stack, so no tools like Sentry or better_errors will ever be able to capture them.

Why

When security scanning of our site takes place we are inundated with these errors in our slack channel. These errors are not serving any purpose since there is no issue to be solved. Therefore we should remove them to keep all our alerts actionable.

We often get exceptions in Sentry coming from a security checking bot that attempts some attacks by using strings with special characters. All of those "attacks" fail, but they produce exceptions which we would like to ignore, so they do not clutter Sentry. On the other hand we don’t want to ignore exceptions of the same class coming from other sources.

Trello card

unoduetre commented 1 month ago

Closing this as unfortunately this approach won't work.