XX-net/XX-Net · warning

%s %s %s haking

Error message

%s %s %s haking

What it means

The web control handler detected '..' in the request path, a classic path-traversal attempt, and rejected it with a 404 ('haking' = hacking). The logged fields identify the client and the offending path.

Source

Thrown at code/default/gae_proxy/local/web_control.py:192

            if file_path.endswith('.html'):
                mimetype = 'text/html'
            elif file_path.endswith('.png'):
                mimetype = 'image/png'
            elif file_path.endswith('.jpg') or file_path.endswith('.jpeg'):
                mimetype = 'image/jpeg'
            else:
                mimetype = 'application/octet-stream'

            self.send_file(file_path, mimetype)
            return
        else:
            xlog.warn('Control Req %s %s %s ', self.address_string(), self.command, self.path)

        # check for '..', which will leak file
        if re.search(r'(\.{2})', self.path) is not None:
            self.wfile.write(b'HTTP/1.1 404\r\n\r\n')
            xlog.warn('%s %s %s haking', self.address_string(), self.command, self.path )
            return


        filename = os.path.normpath('./' + path)
        if self.path.startswith(('http://', 'https://')):
            data = b'HTTP/1.1 200\r\nCache-Control: max-age=86400\r\nExpires:Oct, 01 Aug 2100 00:00:00 GMT\r\nConnection: close\r\n'

            data += b'\r\n'
            self.wfile.write(data)
            xlog.info('%s "%s %s HTTP/1.1" 200 -', self.address_string(), self.command, self.path)
        elif os.path.isfile(filename):
            if filename.endswith('.pac'):
                mimetype = 'text/plain'
            else:
                mimetype = 'application/octet-stream'
            #self.send_file(filename, mimetype)
        else:
            self.wfile.write(b'HTTP/1.1 404\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\n404 Not Found')

View on GitHub (pinned to cfa5bc17b6)

Solutions

  1. If self-triggered: remove '..' from client URLs
  2. Ensure the web control port is only bound to 127.0.0.1 and not exposed
  3. Ignore: the request was already blocked with 404
Defensive patterns

Strategy: validation

Validate before calling

import re
if re.search(r'(\.\.)', path):
    return 404  # reject before touching the filesystem

Prevention

When it happens

Trigger: Any request whose self.path contains two consecutive dots, e.g. GET /../../etc/passwd — including encoded variants that were decoded earlier.

Common situations: Automated scanners or casual probing of the local control port; occasionally a legitimate client issuing a path containing '..' segments. Note the control server listens locally, so exposure means something else is reaching it.

Related errors

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/b2dfba5b2d22a1be. Report an issue: GitHub.