Repository navigation
large mount of "badly formed hexadecimal UUID string" in Inventory log #5393
Description
During a log review, there are large amount of this error in prod inventory. Need to know what kind of web requests causes this error and whether we can ignore it.
...
File "/home/vcap/deps/1/python/lib/python3.10/site-packages/ckan/lib/base.py", line 104, in render
return flask_render_template(template_name, **extra_vars)
File "/home/vcap/deps/1/python/lib/python3.10/site-packages/newrelic/api/function_trace.py", line 157, in literal_wrapper
return wrapped(*args, **kwargs)
File "/home/vcap/deps/1/python/lib/python3.10/site-packages/flask/templating.py", line 150, in render_template
return _render(app, template, context)
File "/home/vcap/deps/1/python/lib/python3.10/site-packages/flask/templating.py", line 131, in _render
rv = template.render(context)
File "/home/vcap/deps/1/python/lib/python3.10/site-packages/newrelic/api/function_trace.py", line 138, in dynamic_wrapper
return wrapped(*args, **kwargs)
File "/home/vcap/deps/1/python/lib/python3.10/site-packages/jinja2/environment.py", line 1295, in render
self.environment.handle_exception()
File "/home/vcap/deps/1/python/lib/python3.10/site-packages/jinja2/environment.py", line 942, in handle_exception
raise rewrite_traceback_stack(source=source)
File "/home/vcap/deps/1/python/lib/python3.10/site-packages/ckanext/datastore/templates/ajax_snippets/api_info.html", line 13, in top-level template code
{% set resource_id = h.sanitize_id(resource_id) %}
File "/home/vcap/deps/1/python/lib/python3.10/site-packages/ckan/lib/helpers.py", line 2695, in sanitize_id
return str(uuid.UUID(id_))
File "/home/vcap/deps/1/python/lib/python3.10/uuid.py", line 177, in __init__
raise ValueError('badly formed hexadecimal UUID string')
Activity
SueValente commentedon Jun 29, 2026
Is this still a thing?
FuhuXia commentedon Jun 30, 2026
I took a closer look and found that they occur when requests contain an invalid UUID in the resource_id parameter, for example:
These requests are automated attempts to exploit public endpoints. The application handles them correctly. There is no security risk. There is no practical way to prevent this traffic from reaching a public endpoint, nor is there a need to do so, as the requests are safely rejected.