When I try to create an image post it doesn’t work. As soon as I click the Publish button the CloudFlare bot checking screen comes up, takes 20-30 seconds to complete, and I’m taken back to an empty post form.
This doesn’t happen with Discussion or Link posts.
You must log in or register to comment.
Hmm, I wasn’t able to reproduce this, but it might depend on the image/your connection/whatever else. @feddit-admin@feddit.online is likely going to have much more insight since they manage the infrastructure.
In the past images occasionally caused issues because of large file sizes. But after moving to webp for my images I haven’t had problems with that. In fact, I was able to create the post by creating a discussion post with an inline image instead: https://feddit.online/c/nanowrimo2@feddit.online/p/2077339/short-update-for-today
That’s what is really weird about this.
Maybe it has something to do with me being on a 4G/5G internet connection?
I don’t think it’s related to your Internet connection. It could be a firewall rule or a missing one.
Can you try it again in the https://feddit.online/c/sandbox community, and then if it fails, post the precise time of the failure, and I’ll see if I can find something in the logs that explains what went wrong?
Okay, just tried it. 17:09-17:10 central time was when it failed (ie, you should see the post submitted @17:09, but the CloudFlare check didn’t clear until 17:10).
In those 2 minutes there are an unbelievable number of entries. Four questions to help me:
- Did you use a browser or a phone app. And which browser or phone app?
- Did you get a Cloudflare challenge? Like check a box to prove you are human?
- Which country are you in?
- If you aren’t willing to share your IP address, can you give me a piece of it that I can match to the request?
Thanks for the help!
I’m in the U.S., using the Waterfox browser on Linux. The first two octets of my IP: 107.77 — hopefully that’s enough to isolate the entries.
No CloudFlare challenge. I suspect it was one of those workload tests (ie, it’s running a script to solve a complex math problem). I could try inspecting the page if that would be helpful.
Thank you! I was able to find it in the Cloudflare logs. And I believe I’ve modified an existing firewall rule that fixes this.
Waterfox is more than capable of managing a challenge. The issue is that Cloudflare believed you submitted a highly toxic payload, and the request was therefore blocked.
OWASP score=70, which is extraordinarily high with the result of BLOCK. Cloudflare believed your image binary was not an image at all but text, and it contained all these malicious characteristics. “Inbound Anomaly Score Exceeded”
920270: Invalid character in request (null character) 3500d96add324dcbbc0a93b2bd22c723 Cloudflare OWASP Core Ruleset Score (+5) 920271: Invalid character in request (non printable characters) a882bfdf91b3440b83020de61d8cf992 Cloudflare OWASP Core Ruleset Score (+5) 932130: Remote Command Execution: Unix Shell Expression Found 0eb6bfdb8e914a07a95aa4e847bc28eb Cloudflare OWASP Core Ruleset Score (+5) 932200: RCE Bypass Technique 753c98e3a15f4a389ea0b196c91b7247 Cloudflare OWASP Core Ruleset Score (+5) 941310: US-ASCII Malformed Encoding XSS Filter - Attack Detected c4926d96b87647329947ec2ccbc01671 Cloudflare OWASP Core Ruleset Score (+5) 941320: Possible XSS Attack Detected - HTML Tag Handler 1fd9e041e6944a5c9c080d19346650ed Cloudflare OWASP Core Ruleset Score (+5) 941340: IE XSS Filters - Attack Detected a2e88d6e0e604f05b9e660567fbedd30 Cloudflare OWASP Core Ruleset Score (+5) 942200: Detects MySQL comment-/space-obfuscated injections and backtick termination f2db062052cf453fbe9e93f058ecf7e7 Cloudflare OWASP Core Ruleset Score (+5) 942260: Detects basic SQL authentication bypass attempts 2/3 6afe6795ee6a48d6a1dfe59255395a78 Cloudflare OWASP Core Ruleset Score (+5) 942300: Detects MySQL comments, conditions and ch(a)r injections cda7fcb45e304a589567d2021821e480 Cloudflare OWASP Core Ruleset Score (+5) 942330: Detects classic SQL injection probings 1/3 293e73c033b34a2290481c4718a93bb2 Cloudflare OWASP Core Ruleset Score (+5) 942370: Detects classic SQL injection probings 2/3 5a6f5a57cde8428ab0668ce17cdec0c8 Cloudflare OWASP Core Ruleset Score (+5) 942440: SQL Comment Sequence Detected d12ad6d1bc0c42b3affe0cee682bb405 Cloudflare OWASP Core Ruleset Score (+5) 942510: SQLi bypass attempt by ticks or backticks detected
Add the score values together, and the score is a remarkable 70. The reason others could not reproduce this is that the binaries for their images didn’t contain as many viral hallucinations per chance.
Maybe a question for Walter, but I’ve had to deal with this before where Cloudflare sees PieFed image uploads, not as binary images, but as text, and I always wondered if the problem is in the PieFed API, because I don’t trip this rule with any other Fediverse app I run.
Anyway, I believe I’ve fixed it by expanding an existing rule that dealt with this issue.
Can you try uploading it again?
Thank you so much for your help on this?
I’ve scheduled an image post for tomorrow morning (8am). Had no issue posting it.
OWASP score=70, which is extraordinarily high with the result of BLOCK. Cloudflare believed your image binary was not an image at all but text, and it contained all these malicious characteristics. “Inbound Anomaly Score Exceeded”
Absolutely insane. I wonder why it decided the image was a text file.
Maybe a question for Walter, but I’ve had to deal with this before where Cloudflare sees PieFed image uploads, not as binary images, but as text, and I always wondered if the problem is in the PieFed API, because I don’t trip this rule with any other Fediverse app I run.
That was my next question: is there a possibility there is a bug someplace in PieFed / API. That would seem like a high probability to me because I was able to upload the image via the editor.
