search

hassanakbar4 / mailarchive-tickets

0 stars 0 forks source link

Malicious requests cause 500 errors #325

Open hassanakbar4 opened 3 years ago

hassanakbar4 commented 3 years ago

component_MailArchive: User Interface type_defect | by rcross@amsl.com

Validate URL parameters to prevent 500 errors

Examples: https://mailarchive.ietf.org/arch/browse/email_list%20=%20'12345%5C'%22%5C%5C%5C'%5C%5C%22);%7C%5D*%5Cx00%7B%5Cr%5Cn%3C%5Cx00%3E%EF%BF%BD%5C'%5C'%F0%9F%92%A1'/

https://mailarchive.ietf.org/arch/search/?f_from=%5C&not-0-field=text%C2%AC-0-qualifier=contains%C2%AC-0-value=1&q=1&qdr=d&query-0-field=text&query-0-qualifier=contains&query-0-value=1&so=date&sso=frm

https://mailarchive.ietf.org/arch/search/f_from=%5C&qdr=d&token=5PqpKyzW1ZNoPWbM

Issue migrated from trac:3266 at 2021-09-22 16:58:22 +0500