Error handing page not trapping all errors - iis

Question

I have this simple error checking page on my classic ASP website and have a custom error page set up so that scripting errors (500 and 500.100) call this error page so that errors are logged into a MySQL table:
<!--#INCLUDE file="db_connection.asp" -->
<%
On Error Resume Next
'crappy function I use
Function newstr(str)
newstr = Server.HTMLencode(str)
newstr = Replace(newstr, "'","''")
newstr = Replace(newstr, "\","\\")
newstr = Replace(newstr, chr(10), "<br />")
End Function
'get all form data and put it into a variable
For ix = 1 to Request.Form.Count
fieldName = Request.Form.Key(ix)
fieldValue = Request.Form.Item(ix)
bb = bb & fieldName & ": " & fieldValue & vbcrlf
Next
bb = newstr(bb)
set objError = Server.getLastError()
strNumber = objError.AspCode & " : " & Err.Number
strSource = objError.Category
strPage = objError.File
strDesc = objError.Description & " : " & ObjError.ASPDescription & " :: " & Err.Description
strDesc = newstr(strDesc)
strCode = Server.HTMLEncode(objError.Source)
If strCode = "" then strCode = "No code available"
strLine = ObjError.Line
strASPDesc = ObjError.ASPDescription
strRemoteAddr = Request.ServerVariables("REMOTE_ADDR")
strLocalAddr = Request.ServerVariables("LOCAL_ADDR")
ref = request.servervariables("HTTP_REFERER")
str = request.servervariables("QUERY_STRING")
ip_url = strRemoteAddr
ua = newstr(request.servervariables("HTTP_USER_AGENT"))
totalstring = strPage & "?" & str
sql = ""
sql = SQL & " INSERT INTO error_log ("
sql = SQL & " er_time, "
sql = SQL & " er_number, "
sql = SQL & " er_source, "
sql = SQL & " er_page, "
sql = SQL & " er_desc, "
sql = SQL & " er_code, "
sql = SQL & " er_line, "
sql = SQL & " er_remote_addr, "
sql = SQL & " er_local_addr, "
sql = SQL & " er_str, "
sql = SQL & " er_ref, "
sql = SQL & " er_type, "
sql = SQL & " ip_url, "
sql = SQL & " er_br, "
sql = SQL & " er_form"
sql = SQL & " ) VALUES ("
sql = SQL & " now(),"
sql = SQL & " '" &strNumber&"',"
sql = SQL & " '"&strSource&"',"
sql = SQL & " '"&strPage&"',"
sql = SQL & " '"&strDesc&"',"
sql = SQL & " '"&strCode&"',"
sql = SQL & " '"&strLine&"',"
sql = SQL & " '"&strRemoteAddr&"',"
sql = SQL & " '"&strLocalAddr&"',"
sql = SQL & " '"&totalstring&"',"
sql = SQL & " '"&ref&"',"
sql = SQL & " '500',"
sql = SQL & " '"&ip_url&"',"
sql = SQL & " '"&ua&"',"
sql = SQL & " '"&bb&"') "
oConn.Execute(sql)
%>
The trouble I'm finding is that lots of lines keep ending up in the error log, but are not triggering Server.getLastError, because all of the variables from that are NULL. And I know that someone isn't directly visiting the URL of the error page because the "strPage" variable, (set by objError.File) is populated.
However, if I visit the page that is erroring, it always works fine.
The pages which are in the error log always have a querystring associated with them - but the ID of that always varies - so e.g. it might be that the "totalstring" (made up of objError.File concatenated with a question mark followed by request.servervariables("QUERY_STRING") could be:
/music/view.asp?id=192
/designs/page.asp?id=5775
/designs/page.asp?id=5797
They all error in the same place, which is:
e = newstr(request("id"))
Where "newstr" is the function mentioned at the top of this page. I know that that function is a load of crap and risks SQL injections etc.
However, in this case, I can't work out why the pages are erroring as they always work fine for me and most of the site users.
What's strange is that the IP addresses of the users getting the errors are always from the same ISP - generally one ISP in Germany.
Could something suspicious be going on in the background? Is there any additional logging I could do to get to the bottom of this?
Update 30th July 2015
Thanks to answer provided by #John, I was able to get to the bottom of this, and avoided errors by putting this at the top of every page:
<%
''get the cookie data
ck = Request.ServerVariables("HTTP_COOKIE")
'' does the cookie data contain "; = true;" somewhere, does not matter where
v1 = instr(ck, "; =true;")
''if the cookie data starts with "=true;" OR if "; =true;" appears somewhere in the cookie, then redirect somewhere else
if left(ck,6) = "=true;" OR v1 > 0 then response.redirect ("somewhere-else.asp")
%>
More info also here:
https://forums.iis.net/p/1226865/2106015.aspx?Re+Request+Cookies+generate+80004005+2147467259+error+if+cookie+with+no+name
Seems to be some hacking type activity originating from ISP Hetzner Online AG

Answer 1

I have been getting a lot of similar errors where no error number is recorded. I found the problem due to the cookies that were being sent and at least one of the cookies having no name.
When you do Request("id") it checks the querystring, form post and then cookies. Classic ASP does not seem capable of handling cookies where there is no name and fails in this situation with an error.
Looking at the requests I am receiving they do look like unusual hack attempts targeting cookies.
To see if this is the case I would suggest you log the cookie HTTP header as well.
One option would be to change from Request to Request.QueryString or Request.Form depending on how you are expecting the parameter to be passed (GET or POST).
If that is not an option then you could add some code to check for this no name cookie problem, something like this should do the job:
On Error Resume Next
Request.Cookies("test")
If Err.Number <> 0 Then Server.Transfer("/common/500.asp")
On Error Goto 0
This just checks whether it is possible to read a cookie, and it doesn't matter what cookie name you use or whether the cookie exists or not. It will end execution if invalid cookies are sent. If you have an include file that is run on every request you could add this to the beginning.
See my own SO question for some further information.