Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle incorrectly UTF-8 encoded query and cookie url (alternative approach) #4348

Closed
wants to merge 1 commit into from

Conversation

unoduetre
Copy link
Contributor

An exception is raised in case the query or the cookie contains an incorrectly encoded UTF-8 string.
As this error is raised before any error capturing middleware is enabled, it will not be captured by e.g. Sentry and it will not show in e.g. better_errors.

⚠️ This repo is Continuously Deployed: make sure you follow the guidance ⚠️

What

Stop sentry alerting on the “invalid byte sequence in UTF-8 errors”.

As discussed with @hannako, we will use a a solution based on an external gem called rack-utf8_sanitizer instead of developing our own gem. This solution will then be used in all our apps by copy-pasting the configuration of this gem.

This PR presentes an alternative approach to resolving this issue. The errors will not go through the normal Rails middleware stack, so no tools like Sentry or better_errors will ever be able to capture them.

Why

When security scanning of our site takes place we are inundated with these errors in our slack channel. These errors are not serving any purpose since there is no issue to be solved. Therefore we should remove them to keep all our alerts actionable.

We often get exceptions in Sentry coming from a security checking bot that attempts some attacks by using strings with special characters. All of those "attacks" fail, but they produce exceptions which we would like to ignore, so they do not clutter Sentry. On the other hand we don’t want to ignore exceptions of the same class coming from other sources.

Trello card

An exception is raised in case the query or the cookie
contains an incorrectly encoded UTF-8 string.
As this error is raised before any error capturing middleware
is enabled, it will not be captured by e.g. Sentry
and it will not show in e.g. better_errors.
@govuk-ci govuk-ci temporarily deployed to govuk-frontend-app-pr-4348 October 28, 2024 11:50 Inactive
@unoduetre unoduetre marked this pull request as ready for review October 28, 2024 12:08
@unoduetre
Copy link
Contributor Author

Closing this as unfortunately this approach won't work.

@unoduetre unoduetre closed this Oct 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants