Repository: cisagov/check-cve-2019-19781

Issue:
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xf6 in position 1144: invalid start byte
# 🐛 Bug Report



```console
$ cve-2019-19781 citrix.beispiel.de
Traceback (most recent call last):
  File "/home/ehret/.local/bin/cve-2019-19781", line 11, in <module>
    load_entry_point('cve-2019-19781', 'console_scripts', 'cve-2019-19781')()
  File "/tmp/check-cve-2019-19781/src/check_cve/check.py", line 117, in main
    if is_vulnerable(host, retries, timeout):
  File "/tmp/check-cve-2019-19781/src/check_cve/check.py", line 64, in is_vulnerable
    decoded_data = response.data.decode()
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xf6 in position 1144: invalid start byte
```


Discussion:

Patch:
diff --git a/src/check_cve/check.py b/src/check_cve/check.py
index 25a8fab..ac27a0f 100755
--- a/src/check_cve/check.py
+++ b/src/check_cve/check.py
@@ -61,7 +61,7 @@ def is_vulnerable(host, retries=2, timeout=10):
 
     logging.debug(f"Response status: {response.status}")
 
-    decoded_data = response.data.decode()
+    decoded_data = response.data.decode("utf-8", errors="ignore")
     logging.debug(f"Data:\n{decoded_data}")
 
     return INSECURE_CONTENT in decoded_data


Test patch:
diff --git a/tests/test_check_cve.py b/tests/test_check_cve.py
index 8919e0c..d922e5d 100644
--- a/tests/test_check_cve.py
+++ b/tests/test_check_cve.py
@@ -128,3 +128,16 @@ def test_non_vuln_host():
             mock_lib.PoolManager().request().status = 403
             return_code = check_cve.check.main()
             assert return_code == 0, "main() should return success"
+
+
+def test_non_utf8_response():
+    """Verify the utility handles responses containing invalid utf-8 data."""
+    # Hebrew string saying "forged"
+    bogus = "מזויף means bogus"
+    bogus_iso_8859_8 = bogus.encode("iso-8859-8")
+    with patch.object(sys, "argv", ["exe_name", "--log-level=debug", "github.com"]):
+        with patch("check_cve.check.urllib3") as mock_lib:
+            mock_lib.PoolManager().request().data = bogus_iso_8859_8
+            mock_lib.PoolManager().request().status = 403
+            return_code = check_cve.check.main()
+            assert return_code == 0, "main() should return success"