Loading...

Details

Type: Bug
Resolution: Timed out
Priority: Medium
Fix Version/s: None
Affects Version/s: 4.2
Component/s: None
Labels:
Environment:

JAC

Introduced in Version:
4.02
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy
Current Status:

Hide

Atlassian Update – 04 December 2017

Hi everyone,

We have recently reviewed this issue and the overall interest in the problem. As the issue hasn't collect votes, watchers, comments, or support cases from many customers during its lifetime, it's very low on our priority list, and will not be fixed in the foreseeable future. That's why we've decided to resolve it as Time Out.

Although we're aware the issue is still important to those of you who were involved in the conversations around it, we want to be clear in managing your expectations. The Jira team is focusing on issues that have broad impact and high value, reflected by the number of comments, votes, support cases, and customers interested. Please consult the Atlassian Bugfix Policy for more details.

We understand how disappointing this decision may be, but we hope you'll appreciate our transparent approach and communication.

Atlassian will continue to watch this issue for further updates, so please feel free to share your thoughts in the comments.

Thank you,
Ignat Alexeyenko
Jira Bugmaster

Show
Atlassian Update – 04 December 2017 Hi everyone, We have recently reviewed this issue and the overall interest in the problem. As the issue hasn't collect votes, watchers, comments, or support cases from many customers during its lifetime, it's very low on our priority list, and will not be fixed in the foreseeable future. That's why we've decided to resolve it as Time Out . Although we're aware the issue is still important to those of you who were involved in the conversations around it, we want to be clear in managing your expectations. The Jira team is focusing on issues that have broad impact and high value, reflected by the number of comments, votes, support cases, and customers interested. Please consult the Atlassian Bugfix Policy for more details. We understand how disappointing this decision may be, but we hope you'll appreciate our transparent approach and communication. Atlassian will continue to watch this issue for further updates, so please feel free to share your thoughts in the comments. Thank you, Ignat Alexeyenko Jira Bugmaster

Description

I have been checking the last sets of JAC logs and I have been noticing WARN level messages such as

2010-09-01 01:28:40,800 http-172.16.3.44-9080-Processor65 WARN anonymous 88x2037118x2 1rek059 /secure/QuickSearch.jspa [jira.jql.query.LikeQueryFactory] Unable to parse the text '[url=http://adderall.iforums.us/#]generic form of adderall[/url] http://valium.iforums.us/# valium no prescription <a href="http://vicodin.iforums.us/#">order vicodin without prescription</a> http://vicodin.iforums.us/# what is vicodin <a href="http://hydrocodone.iforums.us/#">acetaminophen bitartrate hydrocodone vicodin</a> <a href="http://adderall.iforums.us/#">adderall worsening desire to use alcohol</a> [url=http://valium.iforums.us/#]what are slang names for valium[/url] [url=http://vicodin.iforums.us/#]can you liquefy vicodin[/url] <a href="http://clonazepam.iforums.us/#">clonazepam dosage for extreme anxiety</a> <a href="http://adipex.iforums.us/#">cheapest adipex online</a> [url=http://valium.iforums.us/#]valium for dogs[/url] http://redstate.com/users/oxycontin/# false positive for oxycontin
  <a href="http://phentermine.iforums.us/#">phentermine no prescription</a> <a href="http://phentermine.iforums.us/#">cheap phentermine free shipping</a> [url=http://hydrocodone.iforums.us/#]hydrocodone half life[/url] http://lortab.iforums.us/# does zoloft help with lortab withdrawal <a href="http://clonazepam.iforums.us/#">clonazepam fatal dose</a> [url=http://lortab.iforums.us/#]lortab elixir[/url] http://vicodin.iforums.us/# where can i buy vicodin online http://adderall.myeweb.net/# adderall and weight loss <a href="http://lortab.iforums.us/#">how long can lortab be detected</a> [url=http://valium.iforums.us/#]buy valium uk[/url] http://plone.org/author/fioricetonline# is fioricet a controlled substance <a href="http://adderall.iforums.us/#">adderall</a> http://phentermine.iforums.us/# phentermine very cheap [url=http://adderall.myeweb.net/#]side effects of adderall[/url] <a href="http://vicodin.iforums.us/#">signs of vicodin addiction</a> <a href="http://redstate.com/us
 ers/oxycontin/#">withdrawal effects of oxycontin</a> <a href="http://phentermine.iforums.us/#">negative side effects from phentermine</a> http://valium.iforums.us/# valium for sale http://clonazepam.iforums.us/# clonazepam and viagra interaction <a href="http://adipex.iforums.us/#">adipex generic</a> <a href="http://lortab.iforums.us/#">does zoloft help with lortab withdrawal</a> [url=http://adipex.iforums.us/#]success stories of adipex[/url] [url=http://adderall.myeweb.net/#]adderall meth[/url] [url=http://adipex.iforums.us/#]adipex[/url] http://clonazepam.iforums.us/# clonazepam buy mexico [url=http://xanax.iforums.us/#]xanax withdrawal drug[/url] [url=http://plone.org/author/fioricetonline#]fioricet info[/url] [url=http://xanax.iforums.us/#]buy xanax without a prescription or membership[/url] <a href="http://adderall.myeweb.net/#">adderall high crp</a> [url=http://valium.iforums.us/#]valium online[/url] <a href="http://adderall.myeweb.net/#">adderall side effects apraxia<
 /a> [url=http://plone.org/author/fioricetonline#]fioricet does it have asprin in it[/url] <a href="http://xanax.iforums.us/#">what does xanax look like</a> http://valium.iforums.us/# valium addiction http://plone.org/author/fioricetonline# discreet fioricet http://redstate.com/users/oxycontin/# allergy to oxycontin skin sensitivity http://redstate.com/users/oxycontin/# oxycontin addiction http://adipex.iforums.us/# how long does it take adipex to work [url=http://adderall.myeweb.net/#]adderall information[/url] <a href="http://plone.org/author/fioricetonline#">is it legal to buy fioricet online</a> http://clonazepam.iforums.us/# clonazepam addiction http://vicodin.iforums.us/# vicodin mexico [url=http://adderall.myeweb.net/#]drug adderall[/url] [url=http://plone.org/author/fioricetonline#]where can i buy fioricet online[/url] [url=http://adderall.myeweb.net/#]adderall half life[/url] http://lortab.iforums.us/# lortab elixir http://xanax.iforums.us/# xanax overdose [url=http:
 //hydrocodone.iforums.us/#]hydrocodone bitartrate and acetaminophen tablets usp ciii[/url] http://xanax.iforums.us/# how to get high on xanax [url=http://redstate.com/users/oxycontin/#]oxycontin lyrics[/url] [url=http://vicodin.iforums.us/#]will vicodin make you fail a drug test[/url] [url=http://phentermine.iforums.us/#]buy phentermine online[/url] <a href="http://valium.iforums.us/#">valium used</a> ' for field 'summary'.

It seems like our spammer friends have been targeting the QuickSearch form with this sort of content. This highlights that we should probably log this at DEBUG level as it only pollutes the logs with messages that are caused from invalid or incorrect user [or bot in this case] input.

Additionally, it seems to be that we are not doing any client or server side validation of the lenght of this string. According to a conversation I had with Chris M about this the max lenght of a jql query is 3000 characters and the sample string above is 4187 characters long.

We should have both client and server side validation of this. I guess this will have to be investigated to confirm all of this.

It seems like the both changes, specially the logging one should be a simple fix with low-risk, so I guess it could fit into the 4.2 timeframe, but let's see what the triage team say about this.

QuickSearch.jspa is logging at WARN level on JAC when it can't parse queries causing excessive logging. It also seems that we are not doing validation checks on the max-lenght of this string.

Details

Description

Attachments

Activity

People

Dates