Cloudflare-Blocked on Extension Upload #249

New Issue

Patiga · 2024-09-11T23:08:16+02:00

Patiga commented

2024-09-11 23:08:16 +02:00

Whenever I try to submit an extension, I get the cloudflare screen

Sorry, you have been blocked
You are unable to access blender.org
Why have I been blocked?

This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
What can I do to resolve this?

You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

Reproduction steps:

Go to https://extensions.blender.org/accounts/extensions/
Click "Upload New Extension"
Select zip file and agree to terms of service
Click "Upload Extension"

After a couple of seconds, the blocked screen shows up, with a friendly red cross.

I already tried it from two different networks, and rediscovered this old account, on which it happens as well.
Though I didn't clear cookies in between attempts.

Whenever I try to submit an extension, I get the cloudflare screen > Sorry, you have been blocked > You are unable to access blender.org > Why have I been blocked? > > This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data. > What can I do to resolve this? > > You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page. Reproduction steps: 1. Go to https://extensions.blender.org/accounts/extensions/ 2. Click "Upload New Extension" 3. Select zip file and agree to terms of service 4. Click "Upload Extension" After a couple of seconds, the blocked screen shows up, with a friendly red cross. I already tried it from two different networks, and rediscovered this old account, on which it happens as well. Though I didn't clear cookies in between attempts.

Patiga added the

labels 2024-09-11 23:08:16 +02:00

Patiga commented

2024-09-11 23:09:20 +02:00

Close as duplicate (#241)

Patiga closed this issue

2024-09-11 23:09:21 +02:00

Patiga commented

2024-09-11 23:10:15 +02:00

Reopened, as this does appear to be a different issue

Patiga reopened this issue

2024-09-11 23:10:15 +02:00

Patiga commented

2024-09-11 23:12:53 +02:00

As a reference, this is the add-on I try to upload. (link as a gitlab CI artifact)

As a reference, [this](https://gitlab.com/ddnet-rs/twblender/-/jobs/7803131608/artifacts/download) is the add-on I try to upload. (link as a gitlab CI artifact)

Oleg-Komarov commented

2024-09-12 11:38:24 +02:00

Hi @Patiga, thanks for you report!

I've managed to find the corresponding logs on the cloudlflare side.
In future reports it's better to include Cloudflare Ray ID as they suggest in the "block" message, otherwise it might be tricky to find your particular requests in the logs.

The block was triggered by the "Inbound Anomaly Score Exceeded" rule, which combines the score from a few false-positives and decides to block the requests.

I have tweaked the rules a bit, could you please try again?

More details:

Theoretically, the network you are on or a user account shouldn't matter: only the requests payload.
However, when I tried to upload a file that I got by your link, I could submit the form and got a validation error back:

Manifest value error: license for add-ons must be GPL v3.0 or later. Additional license are possible, read the documentation. e.g., ['SPDX:GPL-3.0-or-later'].

Fixing the manifest won't fix the cloudflare block, and I don't know why my request wasn't blocked.

One more related issue: #124

Hi @Patiga, thanks for you report! I've managed to find the corresponding logs on the cloudlflare side. In future reports it's better to include Cloudflare Ray ID as they suggest in the "block" message, otherwise it might be tricky to find your particular requests in the logs. The block was triggered by the "Inbound Anomaly Score Exceeded" rule, which combines the score from a few false-positives and decides to block the requests. I have tweaked the rules a bit, could you please try again? ----- More details: Theoretically, the network you are on or a user account shouldn't matter: only the requests payload. However, when I tried to upload a file that I got by your link, I could submit the form and got a validation error back: > Manifest value error: license for add-ons must be GPL v3.0 or later. Additional license are possible, read the [documentation](https://docs.blender.org/manual/en/latest/advanced/extensions/licenses.html). e.g., ['SPDX:GPL-3.0-or-later']. Fixing the manifest won't fix the cloudflare block, and I don't know why my request wasn't blocked. One more related issue: #124

Patiga commented

2024-09-13 10:50:41 +02:00

Thank you very much for the quick response @Oleg-Komarov!
Sorry for missing the part of the including the ID, my bad!
I tried to submit again, and wasn't blocked this time! 🎉

Inbound Anomaly Score Exceeded sounds a little fishy to me, but I also have zero experience with hosting such websites with Cloudflare ^^
For me this issue is fixed, but I'll leave it to you to close this issue if you deem it resolved.

Thank you very much for the quick response @Oleg-Komarov! Sorry for missing the part of the including the ID, my bad! I tried to submit again, and wasn't blocked this time! 🎉 `Inbound Anomaly Score Exceeded` sounds a little fishy to me, but I also have zero experience with hosting such websites with Cloudflare ^^ For me this issue is fixed, but I'll leave it to you to close this issue if you deem it resolved.

Oleg-Komarov commented

2024-09-13 10:54:17 +02:00

That's great that it helped!

I will close this issue for now, since there's not much we can do without more complaints: it's hard to test it proactively in a meaningful way.

That's great that it helped! I will close this issue for now, since there's not much we can do without more complaints: it's hard to test it proactively in a meaningful way.

👍 1

Oleg-Komarov closed this issue

2024-09-13 10:54:18 +02:00

Sign in to join this conversation.