WCF
WCF copied to clipboard
Gracefully handle exceptions when constructing ServerRequestFactory
The ServerRequestFactory in the RequestHandler is directly exposed to all kinds of untrusted real world garbage:
https://github.com/WoltLab/WCF/blob/78a336120c6245add9545f46ac304a1afcae2d75/wcfsetup/install/files/lib/system/request/RequestHandler.class.php#L76-L87
Some input values, e.g. NUL bytes in headers, might lead to a remotely triggerable exception being emitted within ServerRequestFactory.
We should catch any exceptions thrown from within ServerRequestFactory and immediately halt execution. The result MUST NOT be logged into the error log.