Re:I think tumblr has a huge security hole
by weinzierl on Saturday March 19, 2011 @12:49PM
(#2344031)
Clearly they should make vim mandatory on every machine;-)
I guess the 'i' comes from someone who is used to use vim but in this case using another editor.
That wouldn't have caught this though, this code wasn't even executed, just sent as plain text.
Nginx/varnish can also catch Content-type: text/plain (or text/php?) and treat that like a 5xx response. Yes, that's a bit of a hack, but unless tumblr needs to serve text-files (which I doubt) it's a legit safeguard.
No, joking aside, the normal way to handle this is to have the perimeter server (nginx or varnish) catch any 5* responses and turn them into a user-friendly error-page. That way you never expose sensitive stack traces to your users.
So, this is standard stuff and easy to fix. However who of us hasn't screwed up on a similarly trivial issue before? I wouldn't judge them too hard on this one, happens to the best of us.