Skip to content

Fix JSON::GeneratorError masking errors for malformed UTF-8 request bodies - #1206

Open
grk wants to merge 1 commit into
rollbar:masterfrom
grk:fix-json-generator-error-request-body
Open

Fix JSON::GeneratorError masking errors for malformed UTF-8 request bodies#1206
grk wants to merge 1 commit into
rollbar:masterfrom
grk:fix-json-generator-error-request-body

Conversation

@grk

@grk grk commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Problem

Rollbar::RequestDataExtractor#extract_request_data_from_rack serializes the parsed raw body params to JSON while building the :body field:

:body => Rollbar::JSON.dump(raw_body_params),

This serialization happens before the payload-wide UTF-8 normalization pass that Rollbar::Item runs (Rollbar::Util.enforce_valid_utf8). When a request body contains invalid UTF-8 — for example a malformed request that Rails rejects with ActionController::BadRequestRollbar::JSON.dump raises JSON::GeneratorError: source sequence is illegal/malformed utf-8.

The result is that the original exception being reported gets replaced with a failsafe report, masking the real error (ActionController::BadRequest) from users.

Fix

Normalize the parsed body params with Rollbar::Util.enforce_valid_utf8 inside mergeable_raw_body_params, before they are scrubbed and serialized. This mirrors the existing payload-wide UTF-8 handling and ensures the :body field can always be serialized, so the original error is reported correctly.

The change is limited to error-report payload content; request parsing/validation is unaffected.

Test

Added a spec that feeds a JSON POST body with an invalid UTF-8 byte through extract_request_data_from_rack. Without the fix it raises JSON::GeneratorError; with the fix it returns a valid, UTF-8 :body string.

…odies

extract_request_data_from_rack serializes the parsed raw body params to
JSON while building the :body field, and this happens before the
payload-wide UTF-8 normalization pass in Rollbar::Item. When a request
body contains invalid UTF-8 (e.g. a malformed request that Rails rejects
with ActionController::BadRequest), that serialization raises
JSON::GeneratorError, which replaces the original exception being
reported with a failsafe report.

Normalize the parsed body params with Rollbar::Util.enforce_valid_utf8
in mergeable_raw_body_params, before they are scrubbed and serialized,
so the original error is reported correctly.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant