title: Python Pyramid capturing null byte attacks
body: <p>I have a Pyramid web app with fail2ban set up to jail ten consecutive 404 statuses (i.e. bots that probe for vulnerabilities), Sentry error logging and, as far as I know, there are no security vulnerabilities. However, every few days I get a notification of a 502 caused by a null byte attack. This is harmless, but it has become very tiresome and I ignored a bizarre but legitimate human-user–generated 502 status as a result.</p>
  <p>A null byte attack in Pyramid, in my set-up, raises a URLDecodeError (<code>'utf-8' codec can't decode byte 0xc0 in position 16: invalid start byte</code>) at the url dispatch level, so is not routed to the <code>notfound_view_config</code> decorated view.</p>
  <p>Is there any way to capture <code>%EF</code>/<code>%BF</code> in requests in Pyramid or should I block them in Apache?</p>