Comment 2 for bug 435370

Revision history for this message
Zed A. Shaw (zedshaw) wrote :

Hey, this bug should not be Won't Fix...not at all. It turns out that it's trivial to craft a malformed unicode request to web.py and then cause it to have a UTF-8 error and go into an infinite loop. This is a serious DOS bug, and in addition to that the web.input(_unicode=False) doesn't protect against it. Pass that in with a file upload and it still aborts, goes into an infinite loop.

Two things need to happen:

1) Make _unicode=False unecessary. How?
2) Have a try, if you can't decode the unicode, then it's binary and leave it alone in an except.
3) If _unicode=False is given then assume it's binary and shortcircuit so you don't need to above.

Now, as to why you decided this was don't fix when the original poster said clearly that it pegs their CPU at 100% is beyond me, but now let's frame this as a serious DOS attack against your framework and you work from that premise instead.