# Crafted redirect throws Sidekiq into an infinite loop

**URL:** <https://meta.discourse.org/t/crafted-redirect-throws-sidekiq-into-an-infinite-loop/18128>\
**Category:** Bug\
**Created:** [2014 年 7 月 27 日午後 1:04 UTC](https://meta.discourse.org/t/crafted-redirect-throws-sidekiq-into-an-infinite-loop/18128 "2014-07-27T13:04:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon73329944](https://avatars.discourse-cdn.com/v4/letter/a/a9adbd/32.png) [@anon73329944](https://meta.discourse.org/u/anon73329944)\
**Post date:** [2014 年 7 月 27 日午後 1:04 UTC](https://meta.discourse.org/t/crafted-redirect-throws-sidekiq-into-an-infinite-loop/18128/1 "2014-07-27T13:04:34Z")

</div>

As an attacker, I set up a PHP server with a script:

```plaintext
test2.php:

<?php
header('Location: test2.php?val='.uniqid())
?>

```

and a .htaccess file:

```plaintext
RewriteEngine on
RewriteRule test.png test2.php

```

Then, I went to my local Discourse install and created a few posts with the following link:

```plaintext
http://php-mivexil.rhcloud.com/test.png

```

which Discourse turned into an image. What happened then, however, is shown here:

[http://php-mivexil.rhcloud.com/phplog.log](http://php-mivexil.rhcloud.com/phplog.log)

In short, the Discourse image downloader never stops sending requests. Even after an hour, running tcpdump on Discourse server still shows outgoing traffic.

Additionally, enough of those posts saturate Sidekiq, breaking the whole downloader functionality:

 ![](https://global.discourse-cdn.com/meta/original/4X/3/f/e/3fecb682a5483d51146041289da0e7d6c3bf1b1a.png)  
 ![](https://global.discourse-cdn.com/meta/original/4X/2/5/9/259498252881d3e40eb55247de3d6b27b59ebb78.png)

---

<div class="post-metadata">

**Author:** ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)\
**Post date:** [2014 年 7 月 27 日午後 2:04 UTC](https://meta.discourse.org/t/crafted-redirect-throws-sidekiq-into-an-infinite-loop/18128/2 "2014-07-27T14:04:50Z")

</div>

This topic is now invisible. It will no longer be displayed in any topic lists. The only way to access this topic is via direct link.

---

<div class="post-metadata">

**Author:** ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)\
**Post date:** [2014 年 7 月 27 日午後 2:06 UTC](https://meta.discourse.org/t/crafted-redirect-throws-sidekiq-into-an-infinite-loop/18128/3 "2014-07-27T14:06:55Z")

</div>

Haven’t tested that yet, but made the topic invisible in the case it’s a potential risk.

FYI, next time your report an _attack_, can you please either send a PM to one of the [member of the team](https://meta.discourse.org/groups/discourse/members) or email [team@discourse.org](mailto:team@discourse.org) instead of writing a public topic?

---

<div class="post-metadata">

**Author:** ![anon73329944](https://avatars.discourse-cdn.com/v4/letter/a/a9adbd/32.png) [@anon73329944](https://meta.discourse.org/u/anon73329944)\
**Post date:** [2014 年 7 月 27 日午後 3:06 UTC](https://meta.discourse.org/t/crafted-redirect-throws-sidekiq-into-an-infinite-loop/18128/4 "2014-07-27T15:06:14Z")

</div>

> [@zogstrip](#):
>
> Haven’t tested that yet, but made the topic invisible in the case it’s a potential risk.
> 
> FYI, next time your report an _attack_, can you please either send a PM to one of the [member of the team](https://meta.discourse.org/groups/discourse/members) or email [team@discourse.org](mailto:team@discourse.org) instead of writing a public topic?

Okay, sorry.

It seems like you can only break Sidekiq for half an hour or so. If you do leave an open slot for heartbeats, however, the server will keep following the link until manually stopped.

---

<div class="post-metadata">

**Author:** ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)\
**Post date:** [2014 年 7 月 27 日午後 3:22 UTC](https://meta.discourse.org/t/crafted-redirect-throws-sidekiq-into-an-infinite-loop/18128/5 "2014-07-27T15:22:12Z")

</div>

Thanks for reporting that issue. Just pushed a fix 🐼

[https://github.com/discourse/discourse/commit/488d4eebbe4215d618591429bd8d0b259d3fe9c8](https://github.com/discourse/discourse/commit/488d4eebbe4215d618591429bd8d0b259d3fe9c8)

---

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [2014 年 7 月 29 日午前 4:15 UTC](https://meta.discourse.org/t/crafted-redirect-throws-sidekiq-into-an-infinite-loop/18128/6 "2014-07-29T04:15:27Z")

</div>

クローズされました: 2014 年 7 月 29 日午前 4:15 UTC