search

alphagov / static

GOV.UK static files and resources
https://docs.publishing.service.gov.uk/apps/static.html
MIT License
20 stars 9 forks source link

Handle incorrectly UTF-8 encoded query and cookie url #3468

Closed unoduetre closed 1 week ago

unoduetre commented 2 weeks ago

Follow these steps if you are doing a Rails upgrade.

What

Stop sentry alerting on the “invalid byte sequence in UTF-8 errors”.

As discussed with @hannako, we will use a a solution based on an external gem called rack-utf8_sanitizer instead of developing our own gem. This solution will then be used in all our apps by copy-pasting the configuration of this gem.

Why

When security scanning of our site takes place we are inundated with these errors in our slack channel. These errors are not serving any purpose since there is no issue to be solved. Therefore we should remove them to keep all our alerts actionable.

We often get exceptions in Sentry coming from a security checking bot that attempts some attacks by using strings with special characters. All of those "attacks" fail, but they produce exceptions which we would like to ignore, so they do not clutter Sentry. On the other hand we don’t want to ignore exceptions of the same class coming from other sources.

Trello card

unoduetre commented 2 weeks ago

~Closing this PR as an alternative approach will be used.~