41a0237a87
Automated scanners probing for WordPress paths (/blog/wp/v2/posts/*, POST /) generate a React Router 404 or 405 on every hit, and handleError forwarded all of them to Sentry, exhausting the quota. The existing defence was a list of ignoreErrors regexes that needed a new entry for each scanner pattern. Filter on what the error is instead: shouldReportServerError drops 4xx responses React Router generated itself (internal: true) for requests that matched nothing. Responses the app throws deliberately still report, as do all 5xx and real exceptions. A request carrying a same-origin Referer is still reported, so a broken internal link remains visible in Sentry -- only cold scanner hits are dropped. No HTTP response changes; every URL returns the status and page it did before. Also adds /blog to the Express bot-probe filter so the highest-volume path 404s without an SSR render, and removes the now-redundant route-404 ignoreErrors entries. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ESrxBMZMx2BD9rcKTCgLe4
38 lines
1.4 KiB
TypeScript
38 lines
1.4 KiB
TypeScript
import { createRequestHandler } from "@react-router/express";
|
|
import express from "express";
|
|
import type { ServerBuild } from "react-router";
|
|
import { RouterContextProvider } from "react-router";
|
|
|
|
import { DatabaseContext } from "~/database/context";
|
|
import { db } from "./db";
|
|
import { expressValueContext } from "~/contexts/express";
|
|
|
|
export const app = express();
|
|
|
|
app.use((_, __, next) => DatabaseContext.run(db, next));
|
|
|
|
// Block common bot probe paths before React Router (and Sentry) see them.
|
|
// `blog` is here only because scanners hammer /blog/wp/v2/* — drop it from this
|
|
// list if a real blog route is ever added.
|
|
const BOT_PROBE_RE =
|
|
/\.(php|env|htaccess|aspx|asp|jsp|config|bak|sql|ini|swp|DS_Store)$|^\/(wp-admin|wp-login|phpmyadmin|xmlrpc|server-status|cgi-bin|shell|cmd|console|actuator|blog)(\/|$)/i;
|
|
|
|
app.use((req, res, next) => {
|
|
if (BOT_PROBE_RE.test(req.path)) {
|
|
res.status(404).end();
|
|
return;
|
|
}
|
|
next();
|
|
});
|
|
|
|
app.use(
|
|
createRequestHandler({
|
|
build: () => import("virtual:react-router/server-build") as unknown as Promise<ServerBuild>,
|
|
// @ts-ignore -- RouterContextProvider is the correct runtime type but tsconfig.server.json can't resolve the conditional type statically
|
|
getLoadContext() {
|
|
const provider = new RouterContextProvider();
|
|
provider.set(expressValueContext, "Hello from Express");
|
|
return provider as unknown as RouterContextProvider;
|
|
},
|
|
}),
|
|
);
|