# GbPlugin

**URL:** <https://www.ruby-forum.com/t/gbplugin/188212>\
**Category:** NGINX\
**Created:** [May 7, 2010, 7:15pm UTC](https://www.ruby-forum.com/t/gbplugin/188212 "2010-05-07T19:15:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![WSandrew\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/d07c76/32.png) [@WSandrew\_L](https://www.ruby-forum.com/u/WSandrew_L)\
**Post date:** [May 7, 2010, 7:15pm UTC](https://www.ruby-forum.com/t/gbplugin/188212/1 "2010-05-07T19:15:53Z")

</div>

This user agent is able to create a bad request for image assets that  
is bypassing nginx. We are seeing these odd requests in our Rails  
application (via Passenger) but they should either be 400s or serve  
valid images. A quick google search turns up some interesting history  
on this User-Agent, it seems that it has been compromised by some  
Brazilian malware authors.

Here is an example exception from our application, does anyone see  
anything strange? If I attempt to hit that url in a standard browser I  
get an image, I do not see an accepts header, perhaps this is why  
nginx passing the request on?:

A ActionController::RoutingError occurred in application#index:

No route matches “/images/ajax-loader.gif” with  
{:subdomain=\>“macchiato-assets2”, :method=\>:get,  
:domain=\>“[onehub.com](http://onehub.com)”, :host=\>“[macchiato-assets2.onehub.com](http://macchiato-assets2.onehub.com)”}  
[RAILS\_ROOT]/vendor/rails/actionpack/lib/action\_controller/routing/recognition\_optimisation.rb:66:in  
`recognize\_path’

* * *

## Request:

- URL :  
[http://macchiato-assets2.onehub.com/images/ajax-loader.gif?1273194370](http://macchiato-assets2.onehub.com/images/ajax-loader.gif?1273194370)
- IP address: 200.204.143.221
- Parameters: {“1273194370”=\>nil}
- Rails root: /data/onehub/deploy\_1

* * *

## Session:

- session id: nil
- data: nil

* * *

## Environment:

- CONTENT\_LENGTH : 0

- DOCUMENT\_ROOT :  
/data/onehub/current/public

- HTTP\_CACHE\_CONTROL : no-cache

- HTTP\_CONNECTION : keep-alive

- HTTP\_COOKIE :  
\_onehub\_session\_id=; remember\_me=1

- HTTP\_HOST :  
[macchiato-assets2.onehub.com](http://macchiato-assets2.onehub.com)

- HTTP\_USER\_AGENT : GbPlugin

- HTTP\_X\_FORWARDED\_FOR : 200.204.143.221

- PASSENGER\_APP\_SPAWNER\_IDLE\_TIME : -1

- PASSENGER\_APP\_TYPE : rails

- PASSENGER\_ENVIRONMENT : production

- PASSENGER\_FRAMEWORK\_SPAWNER\_IDLE\_TIME : -1

- PASSENGER\_SPAWN\_METHOD : smart-lv2

- PASSENGER\_USE\_GLOBAL\_QUEUE : true

- PATH\_INFO :  
/images/ajax-loader.gif?1273194370

- QUERY\_STRING :

- RAW\_REQUEST\_URI :  
/images/ajax%2Dloader.gif%3F1273194370

- REMOTE\_ADDR : 10.250.18.33

- REMOTE\_PORT : 48252

- REQUEST\_METHOD : GET

- REQUEST\_URI :  
/images/ajax-loader.gif?1273194370

- SCGI : 1

- SCRIPT\_NAME :

- SERVER\_ADDR : 10.250.182.80

- SERVER\_NAME : 10.250.182.80

- SERVER\_PORT : 80

- SERVER\_PROTOCOL : HTTP/1.1

- SERVER\_SOFTWARE : nginx/0.7.65

- \_ : \_

- action\_controller.request.path\_parameters :

- action\_controller.request.query\_parameters : 1273194370

- action\_controller.request.request\_parameters:

- action\_controller.rescue.request :  
#ActionController::Request:0x10175510

- action\_controller.rescue.response :  
#ActionController::Response:0x101678e8

- rack.errors : #IO:0x98afe18

- rack.input :  
#PhusionPassenger::Utils::RewindableInput:0x10175ab0

- rack.multiprocess : true

- rack.multithread : false

- rack.request.cookie\_hash :

- rack.request.cookie\_string :  
\_onehub\_session\_id=; remember\_me=1

- rack.request.query\_hash : 1273194370

- rack.request.query\_string : 1273194370

- rack.run\_once : false

- rack.session :

- rack.session.options : 

- rack.url\_scheme : http

- rack.version : 10

- Process: 27543

- Server : ip-10-250-182-80

---

<div class="post-metadata">

**Author:** ![WSandrew\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/d07c76/32.png) [@WSandrew\_L](https://www.ruby-forum.com/u/WSandrew_L)\
**Post date:** [May 7, 2010, 7:59pm UTC](https://www.ruby-forum.com/t/gbplugin/188212/2 "2010-05-07T19:59:47Z")

</div>

Mystery solved, it is a poorly configured client that URI encodes the  
query string ?

“GET /images/icons/folder\_read\_16x16.png%3F1273194370 HTTP/1.1”

This should be:

“GET /images/icons/folder\_read\_16x16.png?1273194370 HTTP/1.1”