{"action":"created","issue":{"url":"https://api.github.com/repos/cherrypy/cherrypy/issues/1451","repository_url":"https://api.github.com/repos/cherrypy/cherrypy","labels_url":"https://api.github.com/repos/cherrypy/cherrypy/issues/1451/labels{/name}","comments_url":"https://api.github.com/repos/cherrypy/cherrypy/issues/1451/comments","events_url":"https://api.github.com/repos/cherrypy/cherrypy/issues/1451/events","html_url":"https://github.com/cherrypy/cherrypy/issues/1451","id":163649458,"number":1451,"title":"Information disclosure on bad requests","user":{"login":"aosdf6dd","id":20280659,"avatar_url":"https://avatars.githubusercontent.com/u/20280659?v=3","gravatar_id":"","url":"https://api.github.com/users/aosdf6dd","html_url":"https://github.com/aosdf6dd","followers_url":"https://api.github.com/users/aosdf6dd/followers","following_url":"https://api.github.com/users/aosdf6dd/following{/other_user}","gists_url":"https://api.github.com/users/aosdf6dd/gists{/gist_id}","starred_url":"https://api.github.com/users/aosdf6dd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aosdf6dd/subscriptions","organizations_url":"https://api.github.com/users/aosdf6dd/orgs","repos_url":"https://api.github.com/users/aosdf6dd/repos","events_url":"https://api.github.com/users/aosdf6dd/events{/privacy}","received_events_url":"https://api.github.com/users/aosdf6dd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-07-04T10:36:41Z","updated_at":"2016-07-05T09:02:06Z","closed_at":null,"body":"Hi all!\r\n\r\nI have discovered an information disclosure issue within the web server of cherrypy. By sending invalid characters in the URL it runs into an exception and returns the exception message (without stack trace) to the browser.\r\n\r\nTrigger: Send something invalid in the URL, like: %zz (without URL encoding it)\r\nExpected behaviour: Generic \"Bad Request\" response from the web server\r\nFaulty behaviour present: Exception text like \"invalid literal for int() with base 16: b'zz'\" (without stack trace) is returned as a response.\r\n\r\n![asdf](https://cloud.githubusercontent.com/assets/20280659/16558118/e58a0ed8-41e3-11e6-98ad-f05d548561ea.png)\r\n\r\nwith best regards!"},"comment":{"url":"https://api.github.com/repos/cherrypy/cherrypy/issues/comments/230424594","html_url":"https://github.com/cherrypy/cherrypy/issues/1451#issuecomment-230424594","issue_url":"https://api.github.com/repos/cherrypy/cherrypy/issues/1451","id":230424594,"user":{"login":"aosdf6dd","id":20280659,"avatar_url":"https://avatars.githubusercontent.com/u/20280659?v=3","gravatar_id":"","url":"https://api.github.com/users/aosdf6dd","html_url":"https://github.com/aosdf6dd","followers_url":"https://api.github.com/users/aosdf6dd/followers","following_url":"https://api.github.com/users/aosdf6dd/following{/other_user}","gists_url":"https://api.github.com/users/aosdf6dd/gists{/gist_id}","starred_url":"https://api.github.com/users/aosdf6dd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aosdf6dd/subscriptions","organizations_url":"https://api.github.com/users/aosdf6dd/orgs","repos_url":"https://api.github.com/users/aosdf6dd/repos","events_url":"https://api.github.com/users/aosdf6dd/events{/privacy}","received_events_url":"https://api.github.com/users/aosdf6dd/received_events","type":"User","site_admin":false},"created_at":"2016-07-05T09:02:06Z","updated_at":"2016-07-05T09:02:06Z","body":"Maybe my description was not clear enough. Cherrypy is currently already responding with 400 \"Bad Request\" (see screenshot), which is fine. It just shouldn't disclose error messages!\r\n\r\n![1467709184](https://cloud.githubusercontent.com/assets/20280659/16579347/9c5b8432-429f-11e6-90ee-cf36b42a9640.png)\r\n\r\n\r\nI assume 400 \"Bad Request\" is the correct response because of the following research results:\r\n\r\nThe RFC 3986 (https://www.ietf.org/rfc/rfc3986.txt) definitely mentions that a ‘%’ itself has to be encoded as ‘%25’ in order to avoid issues (last paragraph in chapter 2.4.). But it looks more like a conclusion than a definition…\r\n\r\nLooking at the way other web servers (ngnix, apache, IIS) and large web sites (Amazon, Yandex, Microsoft) handle ‘%zz’, 400 “Bad Request” seems to be the norm:\r\n\r\nhttps://www.google.de/%zz\r\nhttps://www.amazon.de/277-6121422-8654062%zz\r\nhttps://www.yandex.ru/%zz\r\nhttps://httpd.apache.org/%zz\r\nhttps://support.microsoft.com/%zz\r\nhttp://180.250.108.149:9981/%zz (obviously an IIS)\r\n\r\nwith best regards!\r\n"}}
{"actor":{"display_login":"aosdf6dd"}}