search

elixir-plug / plug

Compose web applications with functions
https://hex.pm/packages/plug
Other
2.84k stars 582 forks source link

Add option to decide what to do on invalid UTF-8 urlencoded params #1159

Closed codeadict closed 8 months ago

codeadict commented 1 year ago

Hi there,

Not sure if this proposal is helpful for others or maybe there is a better way to handle this. We don't want to fully disable UTF-8 validation but the current exception raised and 500 error cases a bit of noise when bots try to attack our app or pen-testing software runs against it. Would it be helpful for others in the community to have the option to raise an error or maybe throw a warning log and return 404 for a less noisy experience for people operating the app?

Id be happy to submit a PR in case this is something worth pursuing.

josevalim commented 1 year ago

We could introduce a compile time configuration that changes the status code of the exception.

josevalim commented 11 months ago

PRs welcome!

codeadict commented 11 months ago

Thanks :) Been carried over with kids these days but should have a PR next week.