Brave Tech World

November 9, 2006

    It is not always that you find a major website built by serious developers exposing an ugly call stack to their users. But AOL did it for me:

javax.servlet.ServletException: TEA: Length of String s is not a multiple of 8.
com.aol.search.mvc.DecryptQueryServletFilter.doFilter(DecryptQueryServletFilter.java:112)
com.aol.search.mvc.TestbedServletFilter.doFilter(TestbedServletFilter.java:104)
com.aol.search.mvc.UserAgentBlockFilter.doFilter(UserAgentBlockFilter.java:218)
com.aol.search.msrp.filters.RequestIDOverrideFilter.doFilterInternal(RequestIDOverrideFilter.java:82)
com.aol.search.gsp.filters.AbstractConfiguredServletFilter.doFilter(AbstractConfiguredServletFilter.java:160)
com.aol.search.mvc.LoggingServletFilterBase.doFilter(LoggingServletFilterBase.java:94)
com.aol.search.gsp.filters.LogonTimestampServletFilter.doFilter(LogonTimestampServletFilter.java:94)
com.aol.search.mvc.UserInfoRedirectFilter.doFilter(UserInfoRedirectFilter.java:242)

    All that I did was to change the "encquery" parameter to a normal string. I wanted to see what type of encoding they were using. Apparently the do some cryptography because the function was called "DecryptQueryServletFilter". Why the heck would they cryptograph this value?

    How are websites owners supposed to know what people are looking for on their site if the referer is an encrypted string. If Google had done that from day 1, AdSense and SEO would not exist today.

Comments for "AOL Search code exposed."

No comments posted.