From a9f90cdec3956d43692aab79fef63a19f29034c1 Mon Sep 17 00:00:00 2001 From: Sam Saffron Date: Thu, 2 Jan 2020 12:34:38 +1100 Subject: [PATCH] FIX: avoid superflous logging when mime type is bad Many security scanners ship invalid mime types, this ensures we return a very cheap response to the clients and do not log anything. Previous attempt still re-dispatched the request to get proper error page but in this specific case we want no error page. --- lib/middleware/discourse_public_exceptions.rb | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/lib/middleware/discourse_public_exceptions.rb b/lib/middleware/discourse_public_exceptions.rb index c40f319a3ae..8b9cbc827df 100644 --- a/lib/middleware/discourse_public_exceptions.rb +++ b/lib/middleware/discourse_public_exceptions.rb @@ -31,12 +31,11 @@ module Middleware fake_controller.response = response fake_controller.request = request = ActionDispatch::Request.new(env) + # We can not re-dispatch bad mime types begin request.format rescue Mime::Type::InvalidMimeType - # got to do something here, we can not ship invalid format - # to the exception handler cause it will explode - request.format = "html" + return [400, {}, ["Invalid MIME type"]] end if ApplicationController.rescue_with_handler(exception, object: fake_controller)