By DocSavage on

I've been getting a lot of error messages "Duplicate entry '%s' for key 1 query: INSERT INTO cache (cid, data, created, expire, headers) VALUES ('http..."
There seems to be a broken spider or some irritating bot sending tons of malformed queries of the form "/node/atom/atom/atom/atom..." with a hundred repeated atoms.

Is this some sort of buffer overrun attack targeting Drupal installations? I have banned a number of IPs sending these queries, but there's no shortage of new IPs. Should I just ignore it and hack the administration module to ignore errors of this type? I figure others have run into this or similar issues.

Thanks for any help/suggestions.
-Bill

Comments

jbrauer’s picture

jbrauer commented

Touching this in hopes of a response. On our site we're seeing it as /taxonomy/term/atom/atom/atom.... etc. There is more to the query making it look like an overflow attempt since that's not the end of the query.

--

rjung’s picture

rjung commented

For what it's worth, an issue for this bug has been opened here. Haven't seen a fix yet; I find it more annoying than anything else, but would like to see it squashed.

--R.J.
http://www.electric-escape.net/

--R.J.

killes@www.drop.org’s picture

killes@www.drop.org commented

The bug is with the atom reader it cannot cope with the base href tag that Drupal sets (and which is perfectly ok to do). I suggest blocking the offending atom readers and/or complaining to their authors.
--
Drupal services
My Drupal services

--
Drupal services
My Drupal services

kzeng’s picture

kzeng commented

I got the same problem. Does it have any other negative effects on my drupal powered website apart from continuing to show up in the log?

--------------------------
http://www.kzeng.info

jbrauer’s picture

jbrauer commented

No. I posted a RewriteRule if you want to make the log entries go away and hopefully convince the Atom reader authors to fix their bugs.

--------------------------
Adding Understanding

--