[Moin-user] Where to catch FileTooLong error

Thomas Waldmann tw at waldmann-edv.de
Wed Oct 8 08:01:12 EDT 2014


Moin Nikolaus,

> Several times a day I get the errors like the following in my moinmoin
> server logs:

Yeah, seen them also. Not too often, not causing issues here, so I just
ignored them.

> [Wed Oct 01 17:50:31 2014] [error] [client 176.194.6.204]   File "/usr/lib/python2.7/dist-packages/MoinMoin/Page.py", line 212, in get_body
> [Wed Oct 01 17:50:31 2014] [error] [client 176.194.6.204]     f = codecs.open(self._text_filename(), 'rb', config.charset)
> [Wed Oct 01 17:50:31 2014] [error] [client 176.194.6.204] IOError: [Errno 36] File name too long: '...'
> 
> I believe this is just some attempted exploit failing miserably and no
> cause for concern.

Correct.

Not even sure it is an exploit. Sometimes such stuff are also just
crappy bots using links from crappy services or constructing links badly.

But somehow it looks like trying a buffer overflow, yes (which can't
happen in python).

> What would be the best way to catch this exception and log a short,
> standard message instead?

I guess you could catch it at the place I quoted. Make sure you do not
catch stuff also which you did not want to catch. Maybe check errno?

Important: run your code, practically try if it really fixes the
problem. Run our unit tests (== run ./pytest from top level dir).

> I am proficient in Python, but not in moinmoin. So my question is mostly
> *where* to insert the necessary code, and how to generate the error
> message (just print to stderr, or is there a logging function I should
> use?).

We use the stdlib "logging", just look in some code to find how it is
usually imported and used (our "logging" is NOT the logging module object).

> Ideally, I'd also like to change something in /etc rather than
> changing e.g. "/usr/lib/python2.7/dist-packages/MoinMoin/wsgiapp.py", so
> that the changes are not lost on the next update.

If you get the changes done asap and get them adopted upstream (== by
me), they could be in a release quicker than you think. :D

Cheers,

Thomas




More information about the Moin-user mailing list