search

elixir-plug / plug

Compose web applications with functions
https://hex.pm/packages/plug
Other
2.88k stars 586 forks source link

Plug.Static.InvalidPathError, no debugging information provided #1097

Closed fchabouis closed 2 years ago

fchabouis commented 2 years ago

Hello, We have a reccuring error catched by our Sentry, with Plug.Static raising a Plug.Static.InvalidPathError. Unfortunately, in the stack information given, the URL at the origin of the problematic request is not specified, making it difficult to understand what is happening. Here is an example Sentry output: image

Is there a way I'm missing to get this information? Should the error be enriched with some information about the static asset being requested? Thanks

josevalim commented 2 years ago

Please send a PR that adds the path to the error message, but those are most likely paths with . and .. in them. So most likely someone trying to do some sort of file system traversal or wrong static URLs being generated.

fchabouis commented 2 years ago

Thanks for your answer. I'll do a PR.

fchabouis commented 1 year ago

We finally have the answer, your intuition was right @josevalim!

image

tfantina commented 1 year ago

I have a similar issue with someone trying to directory traversal, it's frankly quite annoying because the client frequently runs bug bounties and such so my Sentry is constantly cluttered with Plug.Static.InvalidPathErrors, I'm wondering what the best way to handle this is. Is there a way to configure PlugStatic not to raise on these errors (to someway handle them gracefully with a redirect or something)? Or should I just add an event filter in Sentry?