search

ietf-tools / mailarchive

IETF Mail List Archives
https://mailarchive.ietf.org
BSD 3-Clause "New" or "Revised" License
38 stars 24 forks source link

Malicious requests to export view cause 500 errors #3768

Closed rpcross closed 1 month ago

rpcross commented 1 month ago

Example: https://mailarchive.ietf.org/arch/export/maildir/?_0xi=uuktc&begindate=mv470&c=z9n8u&callback=qq5u6&cat=biylk&csrf_token=zls2x&email=aijir&email_list=art&emailto=uk5rv&head=sy24v&iframe=lkz85&jsonp=ugk11&keyword=ryriy&lang=ggdgu&m=cty4e&name=beudx&p=iitwt&q=%22pg59b2&s=mlmxz&text=v5m7q&token=6a94CmHXIKXcVOKj&unsubscribe_token=vormq

Causes Internal Server Error: /arch/export/maildir/

RequestError at /arch/export/maildir/ RequestError(400, 'search_phase_execution_exception', 'Failed to parse query ["pg59b2]')