Handle bad xmlrpc data with BadRequest (#1244)

* Handle bad xmlrpc data with BadRequest

helps ignore spam/pentest requests

* Apply pre-commit code formatting

* - add change log entry

---------

Co-authored-by: pre-commit-ci-lite[bot] <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com>
Co-authored-by: Jens Vagelpohl <jens@plyp.com>

Author: 3 people

CHANGES.rst

@@ -10,6 +10,8 @@ https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
 5.11.2 (unreleased)
 -------------------
 
+- Fix error messages from spam/pen test requests.
+
 - Fix a ``ResourceWarning`` emitted when uploading large files.
   (`#1242 <https://github.com/zopefoundation/Zope/issues/1242>`_)
 
@@ -24,6 +26,7 @@ https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
 
 - Update to ``zope.interface = 7.2``.
 
+
 5.11.1 (2024-11-03)
 -------------------
 

src/ZPublisher/HTTPRequest.py

@@ -24,6 +24,7 @@
 from urllib.parse import parse_qsl
 from urllib.parse import unquote
 from urllib.parse import urlparse
+from xmlrpc.client import ResponseError
 
 from AccessControl.tainted import should_be_tainted as base_should_be_tainted
 from AccessControl.tainted import taint_string
@@ -872,7 +873,10 @@ def processInputs(
             if meth is not None:
                 raise BadRequest('method directive not supported for '
                                  'xmlrpc request')
-            meth, self.args = xmlrpc.parse_input(fs.value)
+            try:
+                meth, self.args = xmlrpc.parse_input(fs.value)
+            except ResponseError as e:
+                raise BadRequest(e)
             response = xmlrpc.response(response)
             other['RESPONSE'] = self.response = response
             self.maybe_webdav_client = 0