Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent unsanitized queries from creating Cloudflare errors #226

Merged
merged 6 commits into from
Nov 2, 2024

Conversation

No767
Copy link
Owner

@No767 No767 commented Nov 2, 2024

Summary

This actually has been a bug for a long time, but I haven't noticed this. Within the dictionary commands, you can send an invalid query (e.g. for SQL injection), and Cloudflare would block it. This would result in a content type being HTML, and a HTTP 403 status code would be sent from Discord. There were some folks who abused this to try and get Catherine-Chan to crash thinking that error handling was not implemented and an attempt to block the event loop (which never happened as Catherine-Chan uses aiohttp for HTTP requests, not the requests library)

Types of changes

What types of changes does your code introduce to Catherine-Chan
Put an x in the boxes that apply

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation Update (Updates to README.md, the documentation, etc)
  • Other (if none of the other choices apply)

Checklist

Put an x in the boxes that apply

  • If code changes were made then they have been tested.
    • I have updated the documentation to reflect the changes. (if appropriate)
  • All workflows (except pre-commit.ci) pass with my new changes
  • This PR does not address a duplicate issue or PR

Copy link

sonarcloud bot commented Nov 2, 2024

@No767 No767 merged commit 51e8d02 into main Nov 2, 2024
12 checks passed
@No767 No767 deleted the noelle/prevent-hhtml branch November 2, 2024 21:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant