Do not allow POST requests to /sitemaps - #3491
Conversation
We get relatively frequent vulnerability scans to the sitemaps endpoint, attempting to post data. We should handle this.
2ab14fa to
caf1587
Compare
| serve_from_s3(sitemap) | ||
| end | ||
|
|
||
| post "/sitemaps/*" do |
There was a problem hiding this comment.
I'm not sure this will fix it. The error in Sentry is Invalid multipart/form-data: Rack::Multipart::EmptyContentError (Sinatra::BadRequest) I think this is a bot sending a broken http request to the sitemaps endpoint
It's probably better to catch the Sinatra::BadRequest error like:
error Sinatra::BadRequest do
status 400
"Bad request"
end
There was a problem hiding this comment.
Maybe we need both? If a bot sends a valid body it would hit the post route right?
There was a problem hiding this comment.
I'm actually not sure what would happen. Maybe it would return a 404? We could try it out using curl
|
Marking this as draft, since it's not being actively worked on. There is a Jira ticket that captures this work, so we can reprioritise later: https://gov-uk.atlassian.net/browse/SCH-2004 |
3 participants
We get relatively frequent vulnerability scans to the sitemaps endpoint, attempting to post data. We should handle this.
