We changed vulnerability scanning providers and this error popped up.
Took a while to get this far, but it looks like if I post some invalid data as a post using fiddler to our cf app it throws that error (curl was able to reproduce the problem too).
--------- post from fiddler using 'raw' and don't forget the two carriage returns and last period (.)--------------------
POST https://[yoursite.com]/ HTTP/1.1
Connection: keep-alive
Content-Length: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.6 Safari/534.57.2
Accept: text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Referer: http://www.qualys.com/was/
.
-------------------------- / end --------------------------------------
If you change that last period to something more like a form submission, like:
name=foo
...then it seems to work fine...if you're having trouble getting the data that's being posted, try getting dumping GetHttpRequestData()*
* if you dump that GetHttpRequestData() and look at GetHttpRequestData().content you might see just a string, BUT there might be a null (or other control characters) in there which I think is what's causing our problem. To find the null I needed to something like:
<cffile action="write" file="#thisFile#.log" output="#GetHttpRequestData().content#-#toBase64(GetHttpRequestData().content)#">
I could then see the string that was posted and the base64 encoded version of the string which would help find any.... odd characters that could be be getting dropped because of character sets, trimming, etc.   In notepad++ I was able to see the null value, but decoding the base64 string also showed a extra character in the post.
11
Replies
AdChoices