Smf2.1: Errors when trying to log online activity with really long URLs

[Sesquipedalian]

Today a would-be hacker attempted to get into my forum by appending a bunch of SQL to the URL parameters. It didn't work at all, but it did make an unnecessary mess in my error log.

Specifically, because the appended SQL made the URL really long, it was too big to fit into the url field in the ${db_prefix}_log_online table. Because the hacker made a series of automated attempts, my error log was flooded with complaints about the URL being too long.

One way to avoid the unnecessary error messages would be to truncate the URL string to a reasonable length before trying to insert it into the log_online table. The potential downside of this approach would be that in cases where the URL being accessed exceeded the maximum length, the log wouldn't report the entire URL. I'm not sure if this would be a problem, though.

Another option would be to raise the limit on the field. Right now it is a VARCHAR field with a length of 1024. But no matter how high we raised it, there would always be the possibility that an even longer URL would cause this problem.

Right now I am leaning towards the truncation option, but I am wondering if anyone else has some thoughts on the matter.

[jdarwood007]

https://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers

Seems to suggest 2048 or 4096 might be a safe area to use.

[Sesquipedalian]

That's helpful info, @jdarwood007. Thanks!

Maybe we should update the column length to handle that, and then also truncate any crazily long URLs to fit?

[jdarwood007]

I can't see why not. Seems like that kinda fits us into the best of both options. Any further server debugging should be the web servers access logs themselves

[Oldiesmann]

That sounds like a good idea to me as well.

[Sesquipedalian]

Cool. I'll be travelling for the next two weeks, so I won't be able to take a stab at this until I return. If anyone wants to fix this one in the meantime, by all means do so. :smile:

[colinschoen]

I'll take this.