Managing bad URL: .../

Question

Last couple of months I have been getting a lot of hits from a Synapse bot.  I think whoever coded it must have made an error, as some of the links are truncated to url/.../index.cfm.  (oddly Bing bot seems to have picked up a couple of these).
I say 'bot', but this UA comes from a wide range of IP addresses from all over the globe;I am suspicious.  and I don't think it is a site coding error as it is only triggered with a 'synapse' UA.
Here is the odd thing.  On the test server - in theory identical to the production server - this generates a 404 error, as you would expect.  However, on the production server - theoretically identical, same version of CF (CF9), same config/admin setup, etc - it generates and exception error.  This is more annoying than anything else as it is filling the error log, and setting off unnecessary alarms.  I guess I could write some code in the error.cfm to redirect to 404 if the URL has '...' in it, but would like to understand more about why the two instances of CF are bahaving differently.
Here is some relevant information:
from the CGI variables:
HTTP_REFERER
[empty string]
HTTP_USER_AGENT
Mozilla/4.0 (compatible; Synapse)
PATH_INFO
/.../271/James-McBride
PATH_TRANSLATED
c:\xxxxxxxx\xxxxxxxxx\...\full\index.cfm
REMOTE_USER
[empty string]
REQUEST_METHOD
GET
SCRIPT_NAME
/.../full/index.cfm
and the CFERROR
Browser
Mozilla/4.0 (compatible; Synapse)
DateTime
{ts '2013-06-29 11:18:50'}
Diagnostics
String index out of range: -1 null <br>The error occurred on line -1.
GeneratedContent
[empty string]
HTTPReferer
[empty string]
Mailto
[empty string]
Message
String index out of range: -1
QueryString
[empty string]
RemoteAddress
2.144.163.234
RootCause
struct
Message
String index out of range: -1
StackTrace
java.lang.StringIndexOutOfBoundsException: String index out of range: -1 at java.lang.AbstractStringBuilder.delete(AbstractStringBuilder.java:698) at java.lang.StringBuffer.delete(StringBuffer.java:373) at coldfusion.util.Utils.collapseDotDots(Utils.java:647) at coldfusion.util.Utils.canonicalizeURI(Utils.java:601) at coldfusion.filter.PathFilter.invoke(PathFilter.java:43) at coldfusion.filter.ExceptionFilter.invoke(ExceptionFilter.java:70) at coldfusion.filter.ClientScopePersistenceFilter.invoke(ClientScopePersistenceFilter.java:2 8) at coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:38) at coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:46) at coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38) at coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22) at coldfusion.filter.CachingFilter.invoke(CachingFilter.java:62) at coldfusion.CfmServlet.service(CfmServlet.java:201) at coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:89) at jrun.servlet.FilterChain.doFilter(FilterChain.java:86) at coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringServletFilter.java:42 ) at coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:46) at jrun.servlet.FilterChain.doFilter(FilterChain.java:94) at jrun.servlet.FilterChain.service(FilterChain.java:101) at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106) at jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42) at jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:286) at jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:543) at jrun.servlet.jrpp.JRunProxyService.invokeRunnable(JRunProxyService.java:203) at jrunx.scheduler.ThreadPool$DownstreamMetrics.invokeRunnable(ThreadPool.java:320) at jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.java:428) at jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeRunnable(ThreadPool.java:266) at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)
TagContext
array [empty]
Type
java.lang.StringIndexOutOfBoundsException
Any thoughts, ideas or observations would be welcome!

Answer 1

Not sure why it would be considered a ColdFusion issue.
With URLs, '.' and '..' hold value.  The first means "The current directory" whereas the latter means "Move up a directory", however "..." (and anything more) means nothing.  Dots are also used to separate pathing and filenames from their extension, ie: "folder/files.gif" so that IIS knows which handler to pass off to in order to handle the request.  When you call a ".cfm" file, IIS passes off the request to ColdFusion's handler mapping to process the request.
It seems to me like someone is trying to scrape data from your page.  Maybe via a poorly written HTTP get request and then parsing the data returned.  If the error messages really bug you, you could either go so far as to do a reverse IP lookup (looks like the IP shown there is from the Islamic Republic of Iran), and contact the technical owner for more information on what may be originating from that range.