5

I've recently noticed a number of errors in our sites' error logs which are a result of what appears to be a cache-buster being incorrectly added to URLs.

The requests in question all seem to have "?rand=0.nnnnnnnnnnnnnnnnn" on the end of the URL, with 0.nnnnnnnnnnnnnnnnn being a random number between 0 and 1.

However, this is appended without regard for whether the URL already has querystring parameters, so for example

http://www.mydomain.com/index?category=a&page=1

..is becoming..

http://www.mydomain.com/index?category=a&page=1?rand=0.37218398530967534

Thus causing the page querystring parameter to be "1?rand=0.37218398530967534", not a valid integer.

What I've noticed:

  • All of these requests from from Chrome user agents (Windows and Mac, versions ranging from Chrome 35 to Chrome 39)
  • Many of the requests are from logged-in users (our error logger records cookies) so it's not broken spiders
  • Sometimes there are multiple requests in quick succession, from the same logged-in user, but from different IP addresses. e.g. one example had a hit from 59.95.54.x (an ISP in India) followed one second later by a hit from 162.243.129.x (Digital Ocean, a US cloud hosting company) for the same URL - same random number! - from the same user.

I wonder if it might possibly be some buggy and misbehaving cache-buster extension for Chrome? Although the hits from other IP addresses are odd.

Edit: Craig Hyatt suggested that perhaps the hola.org plugin might be implicated. I took a look at it, and can confirm that it did use a Digital Ocean IP addresses as a proxy when I selected to browse from the USA. Also, looking at the comments on its Chrome extension page, someone said "Your addition of ?rand=*** causes websites that use URL variables to show errors." I looked through the code and couldn't find anything that would do this - but it was just updated yesterday. Possibly a bug that is already fixed?

Further Edit: I was able to confirm that one of the users who has had this error logged is using the hola.org plugin. She will uninstall it and I will monitor whether the error recurs. Also I have emailed Hola support to ask if this is a known issue.

  • 1
    Just started seeing this as well, same as you all Chrome users. No referrer information either, makes me assume plugin or crappy security software. – Richard Benson Nov 25 '14 at 9:54
  • Please cut and paste your explanation into an answer and I will up-vote it in a hurry!! I will withdraw my answer but not until your answer is made. That way, you have access to the comments. Congratulations!! – closetnoc Nov 26 '14 at 2:08
  • I withdrew my answer which took the comments with it I assume. If the OP needs the comments to write an answer, I will be glad to re-instate the answer for him to refer to or help with comments here. I encourage the OP to write an answer so that we can up-vote it. It is a good question/catch and may help others! I am eager to up-vote this for the OP. – closetnoc Nov 26 '14 at 4:40
  • 2
    I had a very similar experience with my users. I also disabled hola and found that fixed the issue. I'll be interested in hearing what you experiences are with hola support – stimms Nov 26 '14 at 5:53
3

I have an application that has started seeing this issue around noon on Nov 20, 2014 (Eastern), with near the exact same issues mentioned.

I was able to connect with one of our users who indicated she was using the Hola.org plugin and I was then able to reproduce the error after installing it myself on Chrome.

Funny thing is although my site was generating 500 errors, as a user I did not receive any. I assume this means Hola is running some background process to retrieve the pages that are not actually being served to the user.

I have contacted the Hola.org support email to let them know of the issue, and directing them to this URL. No response as of yet. Still getting errors on my site but should be able to include some code to scrub the URL of the ?rand=0.XXX.

Also, I am not a fan of how this extension seems to send the same request multiple times, in quick succession, from several IPS as this has the potential to adversely effect some functionality. (ie delete last item on a list, increase counter, send out a standard email, write to a log etc)

  • Hi @Rich .. this definitely seems to be the case. I emailed Hola support and received this acknowledgement: "thank you for contacting us regarding this issue, indeed a deep inspection of the code revealed a bug in a new code segment, this issue is being fixed and will be released in the next daily version (probably later today)." – Carson63000 Nov 26 '14 at 22:08
  • On your final paragraph's concern - is it actually re-issuing POST requests, or just GETs? If it also resends form submissions (POST) then yes, that could be a problem, if it's only re-issuing GET requests, then other than the scenario of increasing a counter many of the other actions should be handled by a POST. – Zhaph - Ben Duguid Nov 28 '14 at 9:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.