Re: Spam attack, observations, how to repair

On Fri, Jul 04, 2014 at 12:45:51PM +0200, Kay Hayen wrote:
> Hello Ralf,
> 
> The attached files would be available as /filexxx/ from the roundup
> server, at least in my configuration, and then they would display as
> HTML.
> 
> Assuming I am not wrong, it appears that it's pretty easy to victimize
> small issue trackers as spam hosts, without the owner noticing. When
> I noticed things, it was usually because of vandalism. Even now, a
> closed issue is something I wouldn't see.
> 
> Also, to me this totally looks like a human doing it.

I'm not so sure, we had similar issues with roundup's own tracker.

> BTW: I just noticed that the above links work, and saw this:
> 
> http://bugs.nuitka.net/file38
> 
> 2014-05-01 13:50:49jwillyunlinkissue3 files <http://bugs.nuitka.net/issue3>
> 2013-10-17 17:25:50dryhorse82settype: text/html -> html 2013-10-17 17:25:46
> dryhorse82linkissue3 files <http://bugs.nuitka.net/issue3>
> 2013-10-17 17:25:46dryhorse82create

> Maybe this gives an indication. Why did he change the content
> type from text/html to html. And apparently now, with the new
> account, he unlinked the file. Very strange.

This is the hint. Roundup only rewrites the content-type "text/html" not
just "html" but it seems the browser wants to be helpful and renders
this as html -- which it shouldn't. I'll fix this so that in this case
we will indicate a content-type of application/octet-stream which the
browser should not render.

> I just checked with your own issue tracker, that both links work:
> 
> http://issues.roundup-tracker.org/file1496/roundupdb.py/
> http://issues.roundup-tracker.org/file1496/roundupdb.py
> 
> The first ought to 404 from roundup in my mind.
No, this alway renders if after the fileXXX a '/' follows.

Note that this file is text/plain and the content-type isn't rewritten
by roundup. For text/html the content-type is rewritten and the file
would not display.

> What I am saying is that, if that file were HTML, it would be rendered
> as HTML, in at least my Chrome browser. I also have evidence of it
> being used, due to web master tools crawling these pages.

Yes, seems to be a feature interaction between the browser and roundup
with a content-type of just 'html'.

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   http://www.runtux.com
Reichergasse 131, A-3411 Weidling       email: [email protected]
allmenda.com member                     email: [email protected]

------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft