Cannot make POST with a large parameter

Nicolai Pedersen

Posted on 21/11/2018 15:39:32

Reply

Hi CHarlotte.

Sounds like the SQL injection module. It will give you a 404. If you run your dev tools in the browser and check the network tab, you can see if there is a header x-dw something. It will tell you if it was SQL injection.

Otherwise try provide us the string you are posting so we can see what it is and if it can be reproduced.

BR Nicolai

Charlotte Mogensen

Posted on 21/11/2018 22:27:28

Reply

Hi Nicolai

Thanks for your prompt reply.

I'm getting the following HTTP headers in the response, nothing with x-dw:

Cache-Control →private

Content-Type →text/html; charset=utf-8

Server →Microsoft-IIS/8.5

x-inj-ts-ms →0

Set-Cookie →ASP.NET_SessionId=2npg2wbvgfsjb0fxffnmsfse; path=/; HttpOnly

X-404-handler-by →dw.404

X-404-status-by →dw

X-Robots-Tag →noindex,nofollow,noarchive

Date →Wed, 21 Nov 2018 21:21:20 GMT

Content-Length →131544

My test string is just 4000 times 'a'. Please, see the attached screenshot.

Nicolai Pedersen

Posted on 26/11/2018 15:18:12

Reply

Hi Charlotte

Tried to reproduce this but can with no problems submit this string:

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Are you sure you do not have something on the server that limits a request?

Charlotte Mogensen

Posted on 27/11/2018 11:49:50

Reply

Hi Nicolai

Any ideas what I should look for?

I have tried to run CURL directly on the server, so I would assume, the server connectivity and Firewall are not the issue. See the attached screenshots with a short parameter and a long one.

IIS parameters maxRequestLength and maxAllowedContentLength are large enough to allow 20Kb request.

One detail, when posting to a non-existing page this header "X-404-handler-detected →dw.404.post" is included. But when I post a large parameter to an existing page, the header is missing in the response. Could it be because Dyanmicweb is somehow changing POST to GET and the parameter becomes a part of query string? The maximum URL length by w3c is 2083, so URLs longer than that will fail.

Br Charlotte

Nicolai Pedersen

Posted on 27/11/2018 15:06:36

Reply

Dynamicweb does not such things (changing posts to gets).

If you post to a page that does not exist - yes you get a 404. If you post to a page that does not exist, Dynamicweb will not run the defined 404 page, but show a dw generated 404 page for security reasons (possible DOS issue).

Can you test another solution if you can post large amounts in forms for editors? I.e. https://www.dynamicweb.dk/om-os/kontakt-os

I cannot access fredensborg95.devcl.bleaudev.dk/politik/borgerdrevne-forslag/opret-dit-forslag/login, so cannot test anything.

BR Nicolai

Charlotte Mogensen

Posted on 27/11/2018 22:21:54

Reply

Hi Nicolai

I can see, that Forms for Editors uses this URL format in action attribute "/Default.aspx?ID=XXX&PID=YYY"

It gives an interresting effect, the first response is still 404 for a large parameter, but it gets changed to 301 Permanent Moved. Afterwards the URL rewirter converts the URL to the user-friendly one with status code 200 OK.

So it's all safe and sound, when it comes to posting a user form, but I need my Dynamicweb page to return the result directly to the client and do not do 301 redirect.

I have created a public page, feel free to test here: https://www.alleroed.dk/testsider-maa-ikke-slettes/bleautest

BR Charlotte

Nicolai Pedersen

Posted on 28/11/2018 07:59:56

Reply

Hi Charlotte

I think Bengtson have found an explanation and will get back on this with a workaround - and a fix.

BR Nicolai

Morten Bengtson

Posted on 28/11/2018 09:39:55

Reply

This post has been marked as an answer

Hi Charlotte :)

I think I have reproduced this and it is indeed related to SQL injection checks.

I have tested by using the text from previous post (aaaaaaaaaa....) and submitted this it in an ItemCreator form and got a 301 redirect.

It seems like the problem primarily occurs when you post something weird - like thousands of identical characters (aaaaaaa.....).
Posting lorem ipsum text also fails quickly - probably because the same text is repeated over and over again.

I then tested by using the entire text from the Hamlet play (150.000+ characters) and was able to submit without any problems and the item was created.

Can you try to see if it works on your site when you submit "real text"?
If it still fails then try to disable sql injection checks for that field (input name) - Settings > Web and HTTP > Security > SQL injection check > Ignore the following fields

/Morten

hamlet.txt

Votes for this answer: 1

Charlotte Mogensen

Posted on 28/11/2018 14:28:05

Reply

Hi Morten

Thanks, it has helped a lot. I've disabled SQL injection via the Settings panel and I'm now getting 200 OK.

But if I'm adding the fields to the ignore list, it still gives me 301. I have ignored the following fields: signature,result,ReturnUrl. Please, see the screenshots attached.

I don't really want to disable SQL injection completely.

BR Charlotte

Charlotte Mogensen

Posted on 28/11/2018 14:30:08

Reply

Sorry, a wrong screenshot in the previous post. Here you go again.

Morten Bengtson

Posted on 28/11/2018 15:15:34

Reply

Try to recycle the application pool on the web server.
It seems like we have a cache issue here. Ignored fields are cached in an internal list which doesn't get updated when you add/remove fields in this setting.

Bug 58123: Cache issue with SQL injection ignored fields

Sorry about the inconvenience.

/Morten

Charlotte Mogensen

Posted on 28/11/2018 15:30:26

Reply

Excellent, the problem is solved.

Thank you Morten and Nicolai

Kristian Kirkholt

Posted on 11/12/2018 15:25:01

Reply

Hi Charlotte

The problem regarding #58123 "Cache issue with SQL injection ignored fields" has now been resolved in Dynamicweb version 9.5.6

To upgrade please choose this version from download:

http://doc.dynamicweb.com/releases-and-downloads/releases

Let me know if you need any more help regarding this

Kind Regards
Dynamicweb Support
Kristian Kirkholt

Developer forum

Cannot make POST with a large parameter

Replies