Catch invalid URL encodings to return proper HTTP 400

occams/views/error.py

@@ -1,50 +1,46 @@
-from pyramid.view import forbidden_view_config, notfound_view_config, view_config
+from pyramid.exceptions import URLDecodeError
+from pyramid.httpexceptions import (
+    HTTPBadRequest,
+    HTTPForbidden,
+    HTTPUnauthorized,
+)
+from pyramid.view import (
+    forbidden_view_config,
+    notfound_view_config,
+    view_config
+)
 
 
 @notfound_view_config(append_slash=True)
 def notfound(exc, request):
+    """"
+    Returns HTTP Not Found only after trying to append a slash to the URL
+    """
     return exc
 
 
-@forbidden_view_config(renderer='../templates/error/forbidden.pt')
+@forbidden_view_config()
 def forbidden(request):
     """
     Error handler when a user has insufficient privilidges.
 
     Note that Pyramid combines unauthorized actions into the Forbidden HTTP
     exception, which means we have to check if the user is authenticated and
-    does not have sufficient prilidges or is not logged in. If they user
-    is not logged in we need to continue the Forbidden exception so it gets
-    picked up by the single-sign-on mechanism (hopefully)
+    does not have sufficient priviliges or is not logged in. If the user
+    is not logged in, we need to continue the Forbidden exception so it gets
+    picked up by the single-sign-on mechanism.
 
     This distinction between 401 and 403 is related to the below ticket:
     Issue 436 of Pylons/pyramid -  Authorisation incorrectly implements
     403 Forbidden against RFC 2616
     """
-
     is_logged_in = bool(request.authenticated_userid)
-
-    if not is_logged_in:
-        request.response.status_code = 401
-    else:
-        request.response.status_code = 403
-
-    return {}
+    return HTTPForbidden() if is_logged_in else HTTPUnauthorized()
 
 
-@view_config(context=Exception, renderer='../templates/error/uncaught.pt')
-def uncaught(exc, request):
+@view_config(context=URLDecodeError)
+def invalid_url_encoding(exc, request):
     """
-    Handler for unexpected exceptions (Coding bugs, etc)
-
-    This handler will present a user-friendly page in production
-    systems, but otherwise will defer to pyramid_debugtoolbar debugging.
+    Handler whent he URL contains malformed encoded strings (i.e. %c5, %80)
     """
-
-    if request.registry.settings.get('debugtoolbar.enabled'):
-        raise
-
-    # explicity render template as 500, otherwise 200 was being passed.
-    request.response.status_code = 500
-
-    return {}
+    return HTTPBadRequest()

setup.py

@@ -21,7 +21,7 @@
     'lingua',                           # i18n
     'python-dateutil',                  # Date parsing
     'python-slugify',                   # path-friendly filenames
-    'pyramid>=1.5',                     # Framework
+    'pyramid>=1.7',                     # Framework
     'pyramid_chameleon',                # Templating
     'pyramid_exclog',                   # Logging for production
     'pyramid_tm',                       # Centralized transations