You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is more of a question / advice on protecting against some types of malformed requests.
We currently have simple simple block
Rack::Attack.blocklist("Block requests with invalid params")do |req|
beginreq.params# just testing that params are validfalserescueRack::QueryParser::InvalidParameterErrortrueendend
This works great for requests like curl -D - --data 'email=xTremx%%72900' localhost:3000/en/login for example.
However, there is another type of malformed requests that causes Rack to throw an EOFError (or soon EmptyContentError). e.g. curl -D - --header 'Content-Type:multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS' localhost:3000/en/login
I know I can also rescue from EOFError. However, if I don't have this block, Rails seems to handle the malformed request fine somehow. I can even access params[:xyz] inside the controller for example. I'm wondering if there's a better/different way to check the request without catching a bunch of specific/less-specific exceptions?
Activity