1

I'm not sure quite how to express this but my NodeJS server has recently been getting errors because some middleware library is unable to parse certain parameters from urls. When I look at which urls this is occurring for, the url appears to be something like

/*!%20%20*%20angular-hotkeys%20v1.4.5%20*%20https://chieffancypants.github.io/angular-hotkeys%20*%20Copyright%20(c)%202014%20Wes%20Cruver%20*%20License:%20MIT%20*/.cfp-hotkeys-container%7Bdisplay:table!important;position:fixed;width:100%;height:100%;top:0;left:0;color:

Yes. That's the url. I know it doesn't look like a url. It's the first 270 characters of a CSS file that I'm using. Periodically other CSS files get requested as well.

What on earth is going on here?

I've looked at the user agents that are sending these requests and it's a mix: chrome 72 on mac, chrome 71 on linux, firefox 64 on mac. So presumably not a rogue browser or spider.

I've looked in my code and these files only have one reference each, such as

<link defer="defer" rel='stylesheet' href="/css/lib/hotkeys.min.css">

(they don't all have defer) and nobody has reported issues with these files not loading.

My plan is to write a little piece of middleware that will intercept these requests as they all start with a css comment /* and return an error before parameter parsing middleware gets grumpy. But this doesn't actually explain what's happening.

MalcolmOcean
  • 113
  • 4
  • Most likely this is caused by some bug in the application. Instead of adding the link to the CSS file in the page, it adds the content of the CSS file. Check your application. – Tero Kilkanen Feb 17 '19 at 19:21
  • seems like the crash was being caused by `body-parser` middleware, although it might occur in other middleware later (I didn't check) – MalcolmOcean Feb 18 '19 at 04:56

1 Answers1

4

You shouldn't see errors in your application for stuff like this. Your application should really be able to handle any url without crying. If there is no content at that URL, just return a 404. The URL is something you don't control and your production webserver will see really weird URLs. Bots trying url-based exploits are still quite common these days.

Having said that, you can simply dump the request headers on such errors, take a look at Referrer and User-Agent to track down how/when this happens.

Andreas Rogge
  • 2,670
  • 10
  • 24