Invalid XML characters in user input are attempted to be sent to Mollom [#1093108]

Comment	File	Size	Author
#23	mollom.invalid-xml.23.patch	4.14 KB	sun

#20	mollom.invalid-xml.20.patch	4.15 KB	sun

#17	mollom.invalid-xml.17.patch	4.01 KB	sun

#15	mollom.invalid-xml.15.patch	3.69 KB	sun

#14	mollom.invalid-xml.14.patch	3.54 KB	sun

#12	mollom.invalid-xml.12.patch	3.44 KB	sun

#10	mollom.invalid-xml.10.patch	3.35 KB	sun

Comment #1

Tom Ash CreditAttribution: Tom Ash commented 20 March 2011 at 21:35

Does anyone else have this opportunity? Surely it's core enough to fix...

Log in or register to post comments

Comment #2

sun

German

Karlsruhe

CreditAttribution: sun commented 20 March 2011 at 21:44

1) Are you reporting those comments to Mollom? Only if you do, the Mollom web service is able to learn about them.

2) You always have the option to add "cialis" and any other unwanted terms to your local spam blacklist. If a comment contains a blacklisted term, it's discarded (blocked) right away.

Log in or register to post comments

Comment #3

sun

German

Karlsruhe

CreditAttribution: sun commented 20 March 2011 at 23:20

Status:

Active

» Postponed (maintainer needs more info)

Log in or register to post comments

Comment #4

Tom Ash CreditAttribution: Tom Ash commented 21 March 2011 at 16:50

Yes, I am - thanks for pointing me to the blacklist, but surely mollom should come with a list of common blacklisted words?

Log in or register to post comments

Comment #5

Tom Ash CreditAttribution: Tom Ash commented 30 March 2011 at 15:55

Anyone who can implement this here? (I'm guessing we can't submit patches of this sort.)

Log in or register to post comments

Comment #6

Tom Ash CreditAttribution: Tom Ash commented 2 May 2011 at 13:59

Status:

Postponed (maintainer needs more info)

» Active

Sigh, guess that's a no...

Log in or register to post comments

Comment #7

sun

German

Karlsruhe

CreditAttribution: sun commented 11 May 2011 at 01:52

Status:

Active

» Postponed (maintainer needs more info)

If this is still the case, can you provide one or more Mollom session IDs from recent log messages for such messages? As this concerns a backend related matter, I'll have to forward them to the Mollom backend engineering team.

Log in or register to post comments

Comment #8

Tom Ash CreditAttribution: Tom Ash commented 14 June 2011 at 10:29

Is this what you want, from http://www.philosofiles.com/admin/reports/mollom ?

All servers unavailable: 'http://174.37.205.152, http://67.228.84.11'
Last error: 1000 'XMLRPC parse problem. The SAX parser returned: An invalid XML character (Unicode: 0x15) was found in the element content of the document.'
Error 1000 from 'http://174.37.205.152' for 'mollom.checkContent': 'XMLRPC parse problem. The SAX parser returned: An invalid XML character (Unicode: 0x15) was found in the element content of the document.'
Data:

post_body = 'Я не могу вынести того,что вы с Недом так несчастны. Не читай мне мораль. Она слишком осторожна при разговоре.

Jimm для нокиа 6500
Карта
ссылка
Скачать бесплатно джим на самсунг
Джим 5230
Аська для нокиа 6303 классик
Icq для samsung c3510
Скачать jimm ru
Джим для нокиа 2700
Icq на телефон jad
Icq для нокиа 7610
Аська для мобильного регистрация
Аська на телефон lg t310i
Джим керри
Лучшая icq для 5800
Аська для нокиа 2630
Аська на телефон 5310
Jimm для nokia s40
Icq 6.5 скачать бесплатно
Карта
Установка icq на мобильный
Аська для nokia c5 00
Best icq скачать на телефон
Аська для нокиа 3500
Аська для самсунга gt b5722

Посмотри, он все пытается. А чтобы туда попасть, надо пройти еще хрен знает сколько улиц. Всё хорошо, Михаэль, преимущество в 30 песчинок. Спокойной ночи. Мы не позволим ниггерам, евреям и латиносам грабить нас. Да ладно. Скажи правду. Вы не читали сегодня газет? Спасибо, мой друг. У вас были порезы и кровоподтёки. Нет, никогда. Зачем? Это я и без тебя знаю. Боже, помоги нам всем. Небольшой подарок. Это то, что я как раз рассказывал Джейку. Остановите его! Только посмотри, на кого ты стала похожа. Латынь, начальный курс! Ты ведь можешь воспользоваться страховкой, если это авария. Это то, кем ты себя возомнил. Фэбээровцы говорили с каждым.
Скачать icq для samsung j770 Jimm эмо Джим бим 530 xpressmusic аська Icq для нокиа н73 Bayan icq для nokia x6 Скачать icq для lg gs290 Icq для nokia 2630 скачать Аська нокиа е65 бесплатно сюда Конструктор icq для нокиа 5800 Новые версии icq на телефон ссылка Icq мобильная Как поставить icq на телефон
Я и надеяться на такое не мог. У него весёлая болезнь. Пожирает тебя изнутри. Это действительно было не плохо. Не знаю. Мы были заняты в реанимации,а потом я пришла и увидела, что его нет. Вы не понимаете. Куинн - очень влиятельный человек. Как дела, большой человек? Ты же знаешь, кем он был, не так ли? Пять, четыре, три, два, один. Да, тело у Дебби Клайн незаурядное.
lkjpojklknlo123nls'
author_name = 'InQuile'
author_ip = '109.230.246.170'
session_id = ''
checks = 'spam'

All servers unavailable: 'http://174.37.205.152, http://67.228.84.11'
Last error: 1000 'XMLRPC parse problem. The SAX parser returned: An invalid XML character (Unicode: 0x12) was found in the element content of the document.'
Error 1000 from 'http://174.37.205.152' for 'mollom.checkContent': 'XMLRPC parse problem. The SAX parser returned: An invalid XML character (Unicode: 0x12) was found in the element content of the document.'
Data:

post_body = 'Это как раз не страшно. Спасибо за компанию. Как я уже говорил, тут редко увидишь новых людей. Как это может быть, по твоему, что Лейкерс имеют больше...

И посвятил книгу моей маме. Мы уже сделали кое-что вместе. Ну, ладно, я пошел. Хорошо, хорошо! Эmo ee aдpec. Дaглacmoн. Кольцо победителей года — Дельфинов. ТЕПЕРЬ ОТСЮДА УБРАТЬСЯ? Теперь многие из тех кандидатов, кого не приняли успешно работают,в то же время, многие из наших парней сидят без дела. Правдивая игра", Чжэ-Сок Ю! Я не вижу! Боже! Здесь ставят щит, понимаете? Иан, они просто дети. Стойте рядовой. Тебе мое благословение нужно? Кристал сказала то же самое. Слишком ранний час для таких занятий! Не то что твой большой жирный еврейский зад. Сейчас ты, наверное, пьяня. для врага страшнее, чем самые/i громкие боевые барабаны/i. Вы ведь останетесь на танцы?
Чаты знакомства перми Сек знакомства в кургане Питерские сексзнакомства Знакомство город иваново Орский сайт сексуальных знакомствъ Служба знакомств ярославль Сергей саратов знакомства Знакомство южная корея сеул Знакомство по инету Год знакомства ответить Интим знакомства с парой Усть знакомства Порно знакомства бийск сюда 4 знакомства для скса
Рори, прекрати меня оскорблять пожалуйста. Думаешь, я должен тебе поверить? Да, Пин пригласил меня на ужин! Оно устроит гнездо в этом районе. Вы двое - туда! Я просто... знаю, что смогу. Нет, смерть, просто смерть без всяких прикрас. Ты говоришь, что тебе ничего не надо, но хочешь иметь всё это. Сейчас еще и дождь пойдет. Так что забудь. '
author_name = 'InQuile'
author_ip = '109.230.246.170'
session_id = ''
checks = 'spam'

All servers unavailable: 'http://174.37.205.152, http://67.228.84.11'
Last error: 1000 'XMLRPC parse problem. The SAX parser returned: An invalid XML character (Unicode: 0x11) was found in the element content of the document.'

Log in or register to post comments

Comment #9

sun

German

Karlsruhe

CreditAttribution: sun commented 15 June 2011 at 13:41

Title:	Text analysis allows comments with 'cialis' links, etc.	» Invalid XML characters in user input are attempted to be sent to Mollom
Component:	Miscellaneous	» Code
Status:	Postponed (maintainer needs more info)	» Active

1000 'XMLRPC parse problem. The SAX parser returned: An invalid XML character (Unicode: 0x11) was found in the element content of the document.'

mmm, that's about correct: http://www.w3.org/TR/2000/REC-xml-20001006#charsets

The module already intercepts invalid UTF-8 character sequences, but it doesn't check whether the user input is valid XML to send via XML-RPC.

Didn't encounter this error anywhere else yet. Maybe it's a new pattern of spambots.

Hence, proper issue title and classification.

@Thomas Ash: However, I don't really see "cialis" in the examples you posted. If you have further examples that do not contain this particular error message about invalid XML characters, then please create a separate issue about those.

Log in or register to post comments

Comment #10

sun

German

Karlsruhe

CreditAttribution: sun commented 24 June 2011 at 01:00

Version:	6.x-1.15	» 7.x-1.x-dev
Status:	Active	» Needs review
Issue tags:		+Needs backport to D7

File	Size
mollom.invalid-xml.10.patch	3.35 KB

Attached patch fixes the bug, including tests.

Log in or register to post comments

Comment #11

sun

German

Karlsruhe

CreditAttribution: sun commented 24 June 2011 at 01:01

Issue tags:

-Needs backport to D7

+Needs backport to D6

oopsie

Log in or register to post comments

Comment #12

sun

German

Karlsruhe

CreditAttribution: sun commented 24 June 2011 at 15:23

File	Size
mollom.invalid-xml.12.patch	3.44 KB

Clarified the _mollom_watchdog() change (which is actually "backported" from the 7.x-class branch).

Log in or register to post comments

Comment #13

sun

German

Karlsruhe

CreditAttribution: sun commented 24 June 2011 at 15:39

Status:

Needs review

» Reviewed & tested by the community

Log in or register to post comments

Comment #14

sun

German

Karlsruhe

CreditAttribution: sun commented 24 June 2011 at 15:44

File	Size
mollom.invalid-xml.14.patch	3.54 KB

Additionally merging in the slightly improved user-facing error message from #964436: Invalid UTF-8 in form values

Log in or register to post comments

Comment #15

sun

German

Karlsruhe

CreditAttribution: sun commented 24 June 2011 at 15:57

File	Size
mollom.invalid-xml.15.patch	3.69 KB

Added some clarifying comments.

Log in or register to post comments

Comment #16

Dries CreditAttribution: Dries commented 25 June 2011 at 23:38

Status:

Reviewed & tested by the community

» Needs work

+++ b/mollom.module
@@ -1129,15 +1129,25 @@ function mollom_form_get_values($form_values, $fields, $mapping) {
+      $data[$key] = '- Invalid UTF-8 -';

This felt a bit ugly. Is that necessary?

+++ b/mollom.module
@@ -1129,15 +1129,25 @@ function mollom_form_get_values($form_values, $fields, $mapping) {
-  if (!$valid_utf8) {
-    form_set_error('mollom', t('Invalid form values. Your submission will not be accepted.'));
+  if (!$valid_utf8 || !$valid_xml) {
+    form_set_error('mollom', t('Your submission contains invalid characters and will not be accepted.'));
     _mollom_watchdog(array(
-      'Invalid UTF-8 in form values' => array(),
+      'Invalid !type in form values' => array('!type' => !$valid_utf8 ? 'UTF-8' : 'XML characters'),
       'Data:<pre>@data</pre>' => array('@data' => $data),
     ));

It would be slightly cleaner to have two if-tests in my mind. Also better for translations.

+++ b/mollom.module
@@ -1901,10 +1911,17 @@ function _mollom_watchdog(array $parts, $severity = WATCHDOG_NOTICE) {
+    // Only prettify NULL, Booleans, arrays, and objects. All other values can

Should be 'boolean' instead of 'Boolean'?

Log in or register to post comments

Comment #17

sun

German

Karlsruhe

CreditAttribution: sun commented 27 June 2011 at 17:45

Status:

Needs work

» Needs review

File	Size
mollom.invalid-xml.17.patch	4.01 KB

This felt a bit ugly. Is that necessary?

Clarified in an inline comment.

It would be slightly cleaner to have two if-tests in my mind. Also better for translations.

I considered that first as well, but

1) this code path is only triggered for the edge-case of invalid form submissions, as of now only seen from spambots -- also, didn't verify it yet, but I hope that we can eliminate this entire UTF8/XML character validation when switching to REST.

2) Mollom's watchdog messages are not translatable, since the potx export script only checks for literal string arguments to t() and watchdog() -- since we're logging via an helper function, these strings are not captured; and since Drupal core still does not provide a no-op function to denote translatable strings, they cannot be translated. Since the strings only appear in logs, I don't think it's worth to spend much time on the issue.

Should be 'boolean' instead of 'Boolean'?

"Boolean" is a proper noun that is always capitalized. It is derived from the inventor's name, George Boole, see http://en.wiktionary.org/wiki/Boolean

Log in or register to post comments

Comment #18

27 June 2011 at 17:48

Status:

Needs review

» Needs work

The last submitted patch, mollom.invalid-xml.17.patch, failed testing.

Log in or register to post comments

Comment #19

Dries CreditAttribution: Dries commented 27 June 2011 at 17:57

Alright then. Feel free to commit this patch once the tests pass. :)

Log in or register to post comments

Comment #20

sun

German

Karlsruhe

CreditAttribution: sun commented 27 June 2011 at 18:11

Status:

Needs work

» Reviewed & tested by the community

File	Size
mollom.invalid-xml.20.patch	4.15 KB

Attached patch updates the tests. The patch depends on other commits, so I'll commit it after backporting and committing the other patches.

Log in or register to post comments

Comment #21

Dries CreditAttribution: Dries commented 27 June 2011 at 22:07

I looked at the patch and it looks good. Feel free to commit this patch as I can't commit it myself right now.

Log in or register to post comments

Comment #22

sun

German

Karlsruhe

CreditAttribution: sun commented 27 June 2011 at 23:56

Version:	7.x-1.x-dev	» 6.x-1.x-dev
Status:	Reviewed & tested by the community	» Patch (to be ported)

Thanks, @Dries. Committed to master.

For D6, #1165360: Form button labels/values are not removed from text analysis post body should be committed first, as it changes the signature of mollom_form_get_values().

Log in or register to post comments

Comment #23

sun

German

Karlsruhe

CreditAttribution: sun commented 30 June 2011 at 14:46

Status:

Patch (to be ported)

» Reviewed & tested by the community

File	Size
mollom.invalid-xml.23.patch	4.14 KB

Same path for D6, testbot safety check.

Log in or register to post comments

Comment #24

sun

German

Karlsruhe

CreditAttribution: sun commented 5 July 2011 at 16:55

Status:

Reviewed & tested by the community

» Fixed

Committed to 6.x-1.x.

Log in or register to post comments

Comment #25

Tom Ash CreditAttribution: Tom Ash commented 6 July 2011 at 11:01

"@Thomas Ash: However, I don't really see "cialis" in the examples you posted. If you have further examples that do not contain this particular error message about invalid XML characters, then please create a separate issue about those."

Thanks, I'll keep an eye out. Glad I was able to point out this XML character problem though.

Log in or register to post comments

Comment #27

23 July 2011 at 17:31

Status:

Fixed

» Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

Log in or register to post comments

Comment #28

24 April 2014 at 17:13

Commit 09f321b on master, fai6, 8.x-2.x, fbajs, actions by sun:

Issue #1093108 by sun: Fixed Invalid XML characters in user input are...

Log in or register to post comments

Comment #29

24 April 2014 at 17:13

Commit 09f321b on master, fai6, 8.x-2.x, fbajs, actions by sun:

Issue #1093108 by sun: Fixed Invalid XML characters in user input are...

Log in or register to post comments

Invalid XML characters in user input are attempted to be sent to Mollom

Comments

Comment #1

Comment #2

Comment #3

Comment #4

Comment #5

Comment #6

Comment #7

Comment #8

Comment #9

Comment #10

Comment #11

Comment #12

Comment #13

Comment #14

Comment #15

Comment #16

Comment #17

Comment #18

Comment #19

Comment #20

Comment #21

Comment #22

Comment #23

Comment #24

Comment #25

Comment #27

Comment #28

Comment #29

Thank you to these Drupal contributors

News items

Our community

Documentation

Drupal code base

Governance of community