On Fri, 2012-09-28 at 03:48 -0700, sergey wrote:
> I'm trying to attach 3rd party service to my site (payment system).
> This service sends information to my Pyramid application at specific
> URL by POST requests. This POST request is non-Unicode and data field
> includes non-ASCII chars. And such request raises UnicodeDecodeError.
> Reproduce such error is easy. Create non-Unicode file and put there
> <form action="http://localhost:6543/" method="post">
> <input type="submit" name="button" value="NON-ASCII CHARS
> HERE">
> </form>
> then open page in browser and press button.
> Even pylonsproject.org return Internal Server Error on such test.
> I have already read at ICR #pyramid that malformed request should
> throw exception. But as for me it is abnormal when simple
> HelloWorldApp that not requires parameters at all have such behavior.
> Some hacker can use it to fill out your exception log or mailbox
> (depending on where your tracebacks goes).
> So... Is there any way to process non-Unicode POST-request inside
> Pyramid application?
This is possibly more of a WebOb thing than a Pyramid thing. WebOb
attempts to decode POST and GET variables when you ask for them, usually
from UTF-8.
If you want to continue to treat these requests as errors but suppress
exceptions, it's pretty easy, just register an exception view for
UnicodeDecodeError:
@view_config(context=UnicodeDecodeError, renderer='string')
def handle_decode_error(request):
return 'Sorry, something is not encoded properly'
If, on the other hand, you don't want the request to be treated as an
error, but you want it to be accepted and processed by something, it's
probably possible, but how you do it would depend on the particulars of
the application. Note that anything that accesses request.POST or
request.params will trigger an attempt at decoding; some Pyramid
predicates do this themselves, and of course if your application does
this, it will trigger the same. So seeing a traceback in the context of
your particular application would probably be necessary.
- C
