CGI::Session::CookieStore::CookieOverflow i Spam

Różne Viagry, Cialiasy, kasety video “One night in Paris” i sam nie wiem co jeszcze próbują mi dodać do bloga komentarze jak bardzo im się podobał wpis i jak jeszcze bardziej warto odwiedzić strony podane poniżej. Blog jest czysty, bo żaden z tych spambotów nie potrafi powiedzieć ile to jest 2+2 (swoją drogą boję się dnia, kiedy się nauczą). Problem w tym, że ostatnio w logu zaczął się pojawiać błąd CGI::Session::CookieStore::CookieOverflow. Ponieżej log:

[quote]/opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/session/cookie_store.rb:111:in close' /opt/ruby-enterprise-1.8.6-20080810/lib/ruby/1.8/cgi/session.rb:324:inclose’
/opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/base.rb:1231:in close_session' /opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/base.rb:1267:inprocess_cleanup_without_session_management_support’
/opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/session_management.rb:140:in process_cleanup_without_components' /opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/components.rb:162:inprocess_cleanup’
/opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/base.rb:537:in process_without_filters' /opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/filters.rb:569:inprocess_without_session_management_support’
/opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/session_management.rb:130:in process' /opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/base.rb:389:inprocess’
/opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/dispatcher.rb:149:in handle_request' /opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/dispatcher.rb:107:indispatch’
/opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/dispatcher.rb:104:in synchronize' /opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/dispatcher.rb:104:indispatch’
/opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/dispatcher.rb:120:in dispatch_cgi' /opt/ruby-enterprise-1.8.6-20080810/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/dispatcher.rb:35:indispatch’[/quote]
Request:

[quote]* URL : http://serwis/blog_posts/23?comment[author]=Bnndknnm&comment[body]=++http%3A%2F%2Fvspllabs.com%2Fokhuo%2Fshowthread.php%3Ft%3D1364+readymix+south+west+http%3A%2F%2Fzuhalexclusive.com%2Ftyvh%2Fshowthread.php%3Ft%3D141+bonhams+auction+stafford+uk+http%3A%2F%2Fwork.sulthan.org%2Fiytf%2Fshowthread.php%3Ft%3D1+recycled+material+portland+oregon+http%3A%2F%2Fyourmegaphone.com%2Ftyvh%2Fshowthread.php%3Ft%3D244+rickitts+http%3A%2F%2Fwww.textor.com.ro%2Ftyvh%2Fshowthread.php%3Ft%3D1543+rattan+spring+base+chair+http%3A%2F%2Fvp.vnet.ee%2Fiytf%2Fshowthread.php%3Ft%3D1468+reviews+of+doggie+dooley+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D374+raleigh+future+apartments+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D241+rakastunut+wallu+valpioon+http%3A%2F%2Fcardetailer.com.ar.elserver.com%2Fpijk%2Fshowthread.php%3Ft%3D915+boys+trench+coat+http%3A%2F%2Fvzlom.coolpage.biz%2Fokhuo%2Fshowthread.php%3Ft%3D7437+buderus+foundary+&comment[email]=izywapqg%40vqootzek.com&comment[uri]=++http%3A%2F%2Fvspllabs.com%2Fokhuo%2Fshowthread.php%3Ft%3D1364+readymix+south+west+http%3A%2F%2Fzuhalexclusive.com%2Ftyvh%2Fshowthread.php%3Ft%3D141+bonhams+auction+stafford+uk+http%3A%2F%2Fwork.sulthan.org%2Fiytf%2Fshowthread.php%3Ft%3D1+recycled+material+portland+oregon+http%3A%2F%2Fyourmegaphone.com%2Ftyvh%2Fshowthread.php%3Ft%3D244+rickitts+http%3A%2F%2Fwww.textor.com.ro%2Ftyvh%2Fshowthread.php%3Ft%3D1543+rattan+spring+base+chair+http%3A%2F%2Fvp.vnet.ee%2Fiytf%2Fshowthread.php%3Ft%3D1468+reviews+of+doggie+dooley+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D374+raleigh+future+apartments+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D241+rakastunut+wallu+valpioon+http%3A%2F%2Fcardetailer.com.ar.elserver.com%2Fpijk%2Fshowthread.php%3Ft%3D915+boys+trench+coat+http%3A%2F%2Fvzlom.coolpage.biz%2Fokhuo%2Fshowthread.php%3Ft%3D7437+buderus+foundary+&comment[user_captcha]=++http%3A%2F%2Fvspllabs.com%2Fokhuo%2Fshowthread.php%3Ft%3D1364+readymix+south+west+http%3A%2F%2Fzuhalexclusive.com%2Ftyvh%2Fshowthread.php%3Ft%3D141+bonhams+auction+stafford+uk+http%3A%2F%2Fwork.sulthan.org%2Fiytf%2Fshowthread.php%3Ft%3D1+recycled+material+portland+oregon+http%3A%2F%2Fyourmegaphone.com%2Ftyvh%2Fshowthread.php%3Ft%3D244+rickitts+http%3A%2F%2Fwww.textor.com.ro%2Ftyvh%2Fshowthread.php%3Ft%3D1543+rattan+spring+base+chair+http%3A%2F%2Fvp.vnet.ee%2Fiytf%2Fshowthread.php%3Ft%3D1468+reviews+of+doggie+dooley+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D374+raleigh+future+apartments+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D241+rakastunut+wallu+valpioon+http%3A%2F%2Fcardetailer.com.ar.elserver.com%2Fpijk%2Fshowthread.php%3Ft%3D915+boys+trench+coat+http%3A%2F%2Fvzlom.coolpage.biz%2Fokhuo%2Fshowthread.php%3Ft%3D7437+buderus+foundary+

[quote]* session id: “BAh7BzoOcmV0dXJuX3RvIisvYmxvZ19wb3N0cy8yMy9ibG9nX2NvbW1lbnRz\nP2NhcHRjaGE9NyIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6\nOkZsYXNoSGFzaHsGOghlcnIiQ1R3w7NqIGtvbWVudGFyeiBuaWUgem9zdGHF\ngiB6YXBpc2FueS4gV3lwZcWCbmlqIHd5bWFnYW5lIHBvbGEuBjoKQHVzZWR7\nBjsHRg==–7671aeefa16f940a83b62c320eea8d05ffb4681a”

  • data: {:csrf_id=>“6c39f922c5b12bb14376257539a0de9c”,
    “flash”=>{},
    :return_to=>
    “/blog_posts/23?comment%5Bauthor%5D=Bnndknnm&comment%5Bbody%5D=++http%3A%2F%2Fvspllabs.com%2Fokhuo%2Fshowthread.php%3Ft%3D1364+readymix+south+west+http%3A%2F%2Fzuhalexclusive.com%2Ftyvh%2Fshowthread.php%3Ft%3D141+bonhams+auction+stafford+uk+http%3A%2F%2Fwork.sulthan.org%2Fiytf%2Fshowthread.php%3Ft%3D1+recycled+material+portland+oregon+http%3A%2F%2Fyourmegaphone.com%2Ftyvh%2Fshowthread.php%3Ft%3D244+rickitts+http%3A%2F%2Fwww.textor.com.ro%2Ftyvh%2Fshowthread.php%3Ft%3D1543+rattan+spring+base+chair+http%3A%2F%2Fvp.vnet.ee%2Fiytf%2Fshowthread.php%3Ft%3D1468+reviews+of+doggie+dooley+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D374+raleigh+future+apartments+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D241+rakastunut+wallu+valpioon+http%3A%2F%2Fcardetailer.com.ar.elserver.com%2Fpijk%2Fshowthread.php%3Ft%3D915+boys+trench+coat+http%3A%2F%2Fvzlom.coolpage.biz%2Fokhuo%2Fshowthread.php%3Ft%3D7437+buderus+foundary+&comment%5Bemail%5D=izywapqg%40vqootzek.com&comment%5Buri%5D=++http%3A%2F%2Fvspllabs.com%2Fokhuo%2Fshowthread.php%3Ft%3D1364+readymix+south+west+http%3A%2F%2Fzuhalexclusive.com%2Ftyvh%2Fshowthread.php%3Ft%3D141+bonhams+auction+stafford+uk+http%3A%2F%2Fwork.sulthan.org%2Fiytf%2Fshowthread.php%3Ft%3D1+recycled+material+portland+oregon+http%3A%2F%2Fyourmegaphone.com%2Ftyvh%2Fshowthread.php%3Ft%3D244+rickitts+http%3A%2F%2Fwww.textor.com.ro%2Ftyvh%2Fshowthread.php%3Ft%3D1543+rattan+spring+base+chair+http%3A%2F%2Fvp.vnet.ee%2Fiytf%2Fshowthread.php%3Ft%3D1468+reviews+of+doggie+dooley+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D374+raleigh+future+apartments+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D241+rakastunut+wallu+valpioon+http%3A%2F%2Fcardetailer.com.ar.elserver.com%2Fpijk%2Fshowthread.php%3Ft%3D915+boys+trench+coat+http%3A%2F%2Fvzlom.coolpage.biz%2Fokhuo%2Fshowthread.php%3Ft%3D7437+buderus+foundary+&comment%5Buser_captcha%5D=++http%3A%2F%2Fvspllabs.com%2Fokhuo%2Fshowthread.php%3Ft%3D1364+readymix+south+west+http%3A%2F%2Fzuhalexclusive.com%2Ftyvh%2Fshowthread.php%3Ft%3D141+bonhams+auction+stafford+uk+http%3A%2F%2Fwork.sulthan.org%2Fiytf%2Fshowthread.php%3Ft%3D1+recycled+material+portland+oregon+http%3A%2F%2Fyourmegaphone.com%2Ftyvh%2Fshowthread.php%3Ft%3D244+rickitts+http%3A%2F%2Fwww.textor.com.ro%2Ftyvh%2Fshowthread.php%3Ft%3D1543+rattan+spring+base+chair+http%3A%2F%2Fvp.vnet.ee%2Fiytf%2Fshowthread.php%3Ft%3D1468+reviews+of+doggie+dooley+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D374+raleigh+future+apartments+http%3A%2F%2Fxanthochroid.net%2Ftyvh%2Fshowthread.php%3Ft%3D241+rakastunut+wallu+valpioon+http%3A%2F%2Fcardetailer.com.ar.elserver.com%2Fpijk%2Fshowthread.php%3Ft%3D915+boys+trench+coat+http%3A%2F%2Fvzlom.coolpage.biz%2Fokhuo%2Fshowthread.php%3Ft%3D7437+buderus+foundary+”}[/quote]
    Z tego co wyczytałem w dokumentacji, to standardowa sesja ma rozmiar 4K i przekroczenie tej liczby powoduje właśnie wyjątek: CookieOverflow. Problem się pojawia, gdy spamboty tworzą wielką wiadomość i return_to przyjmuje za dużą wartość.

Pytanie: Jak sobie z tym poradzić?

Z tego co rozumiem, to mam 2 rozwiązania:

  1. Nie korzystać w tej akcji z return_to i nie zapamiętywać tej ścieżki w sesji (słabe, bo wtedy tracę również zawartość komentarzy użytkowników, które nie przeszły walidacji).
  2. Wyłączyć loga dla tej akcji, ale to mi się nie podoba jeszcze bardziej, bo to takie zamiatanie śmieci pod dywan

No i dodatkowo jest problem, gdy użytkownik wpisze zbyt duży komentarz (więcej niż 4K) i nie poda np. adresu email. Wtedy jemu się pojawi taki błąd.
Jakieś sugestie? (Może ograniczyć liczbę znaków na inpucie?)

  1. Nie musisz trzymać niezwalidowanego posta w sesji: treść musi przeżyć tylko od jednego requestu do drugiego – łykasz POSTem i zwracasz w treści formularza “do poprawy”
  2. Jeśli już musisz, to pozostaje zmiana sesji na trzymaną w pliku lub bazie po stronie serwera.

Gapa ze mnie. Nie wiem czemu myślałem, że potrzebuję przechowywać to wszystko w sesji. Wystarczyło wyłączenie zapisywania return_to i wszystkie problemy rozwiązane. Dzięki.