Double slashes after node in URL reveals technical info

Posted by OliverH on November 10, 2012 at 8:14pm

I found the following error in my PostgreSQL log:

[2-1] ERROR:  invalid input syntax for integer: "" at character 535
[2-2] STATEMENT:  SELECT revision.vid AS vid, base.uid AS uid, revision.title AS title, revision.log AS log, revision.status AS status, revision.comment AS comment, revision.promote AS promote, revision.sticky AS sticky, base.nid AS nid, base.type AS type, base.language AS language, base.created AS created, base.changed AS changed, base.tnid AS tnid, base.translate AS translate, revision.timestamp AS revision_timestamp, revision.uid AS revision_uid
[2-3]  FROM 
[2-4]  node base
[2-5]  INNER JOIN node_revision revision ON revision.vid = base.vid
[2-6]  WHERE  (base.nid IN  (''))

As it turns out, someone requested the following url:
http://example.org/node//1

If that URL is formatted correctly with singular slashes it presents the 'basic-page' with ID 1, but with those double slashes it presents:

PDOException: SQLSTATE[22P02]: Invalid text representation: 7 ERROR: invalid input syntax for integer: "" LINE 5: WHERE (base.nid IN ('')) ^: SELECT revision.vid AS vid, base.uid AS uid, revision.title AS title, revision.log AS log, revision.status AS status, revision.comment AS comment, revision.promote AS promote, revision.sticky AS sticky, base.nid AS nid, base.type AS type, base.language AS language, base.created AS created, base.changed AS changed, base.tnid AS tnid, base.translate AS translate, revision.timestamp AS revision_timestamp, revision.uid AS revision_uid FROM {node} base INNER JOIN {node_revision} revision ON revision.vid = base.vid WHERE (base.nid IN (:db_condition_placeholder_0)) ; Array ( [:db_condition_placeholder_0] => ) in DrupalDefaultEntityController->load() (regel 196 van /path/to/documentroot/includes/entity.inc).

I'm using Drupal 7.17, PostgreSQL 9.0.10, PHP 5.3.18 and Apache httpd 2.2.22 on FreeBSD 8.3-p3 amd64

Is anyone else seeing this? Is there something I can do to prevent this from happening?

Comments

Workaround

Posted by OliverH on November 11, 2012 at 3:05pm

Of course disabling all messages from the developement settings prevents the display of technical information, but it still breaks the 'feel' of the website. So to counter the problem and in breaking with the adage of not editting drupal core, I've added a new line 192 before the old one:

<?php
if (isset($ids[0]) && $ids[0] === '') { $ids[0] = '1'; }
?>

So this sends the visitor back to node 1 if there are double slashes after node, regardless of the integer that comes after it.

I'll create a bug report to see if I can garner some more interest in this issue.