Bots with Fake carts

Zen 2.1.0-2.2.2 PHP 8.3/8.5
Bootstrap

I am working of eliminating those dang bots with active carts with nothing in them. They access, first load urls like

index.php?main_page=shopping_cart&disp_order=8&manufacturers_id=8&page=6&products_id=230

This triggers active cart, but no contents. This parameter pollution or URL permutation crawling sucks up resources when you have 100 or so of these fake IP bots with active carts.

I am testing

if (
    isset($_SESSION['cart'])
    && (int)$_SESSION['cart']->count_contents() < 1
) {
    header('Location: /', true, 302);
    exit;
}

in /includes/modules/pages/shopping_cart/header_php.php just after the opening page tag.

This appears to be a possible solution & I am currently live testing it.

I initially tried

<IfModule mod_rewrite.c>
RewriteEngine On

RewriteCond %{QUERY_STRING} (^|&)main_page=shopping_cart(&|$) [NC]
RewriteCond %{HTTP_REFERER} !^https://(www\.)?your-domain\.com/ [NC]
RewriteRule ^index\.php$ /index.php [R=302,L]
</IfModule>

However, .htaccess can't tell somebody actually added an product to the cart. It only sees the HTTP request. The Referer header can also be missing, limited, or faked. So, the rule might redirect a real shopper who opens the cart in a new tab (like me) or uses privacy software.

Any thoughts?

~Melanie

I don't understand the meaning of

This triggers active cart, but no contents. This parameter pollution or URL permutation crawling sucks up resources when you have 100 or so of these fake IP bots with active carts.

What's your definition of an "active cart"?

lat9:

I don't understand the meaning of

What's your definition of an "active cart"?

These have been burning through resources like crazy

Zen cart won't let me use an image by upload, nor link

https://pro-webs.net/help/ff.png

That image looks to be from (maybe) Zen Cart 2.1.0, since 2.2.x oversanitized various elements of the User Agent string into tildes (~).

I'm not able (on zc2.2.2) to reproduce the "active cart" display, but I do see that the breadcrumbs on the shopping cart page include an invalid "category" link.

lat9:

That image looks to be from (maybe) Zen Cart 2.1.0, since 2.2.x oversanitized various elements of the User Agent string into tildes (~).

I'm not able (on zc2.2.2) to reproduce the "active cart" display, but I do see that the breadcrumbs on the shopping cart page include an invalid "category" link.

Right, but are still sucking away at resources in 2.2.2? Zen clearly recognizes the nature of the cart & does not consider it active. That doesn't tell me IF it is doing anything to prevent the resource burning. The cases I have 2.10 & 2.2.2 are all experiencing the resource abuse, no matter what who's online says. Like leeches attached all day every day.

Nope, I'm seeing that the breadcrumbs' initialization unconditionally pulls in a category name and/or product name simply by the presence of the associated $_GET variables.

I'll create a tracking issue on the Zen Cart Github ...

... https://github.com/zencart/zencart/issues/7921

Previous fix doesn't work. Now I'm testing

tpl_main_page.php

Find

<?php if (!$breadcrumb->isEmpty() && (DEFINE_BREADCRUMB_STATUS === '1' || (DEFINE_BREADCRUMB_STATUS === '2' && !$this_is_home_page))) { ?>

or similar

Replace with

<?php if (
    $current_page_base !== 'shopping_cart'
    && !$breadcrumb->isEmpty()
    && (
        DEFINE_BREADCRUMB_STATUS === '1'
        || (DEFINE_BREADCRUMB_STATUS === '2' && !$this_is_home_page)
    )
) { ?>

Looks promising

Here's what I'm using on one site (tpl_main_page.php)

$disable_breadcrumbs = 'shopping_cart,faq,contact_us,login,create_account,checkout_one,account,brands,quick_reorder,checkout_shipping,checkout_payment,checkout_confirmation';

if (!$breadcrumb->isEmpty() && (DEFINE_BREADCRUMB_STATUS == '1' || (DEFINE_BREADCRUMB_STATUS == '2' && !$this_is_home_page)) && !in_array($current_page_base, explode(',',$disable_breadcrumbs))) { ?>

Don't think any of these pages need breadcrumbs. Feel free to expand the list based on your requirements.

We opted to use an opt-in list because fewer pages "use" it, than "don't use it":
https://github.com/zencart/zencart/pull/7924/changes#diff-85054aa37f58a912fe5f8e6916e7f8b3b6185cff119c992e25af369ed3b6a5f2

**@mprough

1. see **https://www.zen-cart.com/showthread.php/231150-abnormal-visitor-numbers?p=1411984#post1411984, as PR #7931 may be worth applying, particularly since it's straightforward.

2. The breadcrumb-bypass should be stopping the additional wasted queries, which should mean that server resources aren't affected as much by such bot activity.
   And the max-cart-items threshold, despite being very generous, should also throttle things a little.

There are 4 whos-online statuses. The active/inactive only means "time last click is within last 180s" or not.
So "active cart" means "clicked something in the last 3 minutes AND currently has >=1 valid item in cart".

... and yet, I note that your screenshots show lots which are active, perhaps with "0" items ... which is puzzling.

3. I'm looking at some $_GET filtering like was suggested earlier. An heurisitic that sends some early 429's would clean things up a lot.

The active "0" item carts are because the troll is requesting the parameter clad shopping cart URL first in many instances. Also many instances of clear bots with spawned IPs and 1 product only in their cart. Different products, only ever 1.

Working on a GET inoculation map https://github.com/zencart/zencart/pull/7932
Feedback welcome