Strange files in the cache/complied/blueprints directory

q3d · January 7, 2024, 3:58pm

In directories:

cache/complied/blueprints
cache/complied/config
cache/complied/languages

I noticed the creation of strange files with names such as:

master-www.myetherwakket.com.pl,
master-lifinity.io.php
etc

when my website has a completely different domain.

The following entries also appeared in the logs/grav.log file:

[2024-01-03 08:37:07] grav.CRITICAL: Unclosed '[' on line 5673 - Trace: #0 /var/www/html/system/src/Grav/Common/Config/CompiledBase.php(112): Grav\Common\Config\CompiledBase->loadCompiledFile() #1 /var/www/html/system/src/Grav/Common/Service/ConfigServiceProvider.php(106): Grav\Common\Config\CompiledBase->load() #2 /var/www/html/system/src/Grav/Common/Service/ConfigServiceProvider.php(46): Grav\Common\Service\ConfigServiceProvider::blueprints() #3 /var/www/html/vendor/pimple/pimple/src/Pimple/Container.php(122): Grav\Common\Service\ConfigServiceProvider->Grav\Common\Service\{closure}() #4 /var/www/html/system/src/Grav/Common/Service/ConfigServiceProvider.php(133): Pimple\Container->offsetGet() #5 /var/www/html/system/src/Grav/Common/Data/Data.php(272): Grav\Common\Service\ConfigServiceProvider::Grav\Common\Service\{closure}() #6 /var/www/html/system/src/Grav/Common/Data/Data.php(156): Grav\Common\Data\Data->blueprints() #7 /var/www/html/system/src/Grav/Common/Themes.php(334): Grav\Common\Data\Data->joinDefaults() #8 /var/www/html/system/src/Grav/Common/Themes.php(282): Grav\Common\Themes->loadConfiguration() #9 /var/www/html/system/src/Grav/Common/Themes.php(64): Grav\Common\Themes->configure() #10 /var/www/html/system/src/Grav/Common/Processors/ThemesProcessor.php(35): Grav\Common\Themes->init() #11 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Common\Processors\ThemesProcessor->process() #12 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #13 /var/www/html/system/src/Grav/Common/Processors/PluginsProcessor.php(39): Grav\Framework\RequestHandler\RequestHandler->handle() #14 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Common\Processors\PluginsProcessor->process() #15 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #16 /var/www/html/system/src/Grav/Common/Processors/InitializeProcessor.php(130): Grav\Framework\RequestHandler\RequestHandler->handle() #17 /var/www/html/system/src/Grav/Common/Debugger.php(546): Grav\Common\Processors\InitializeProcessor::Grav\Common\Processors\{closure}() #18 /var/www/html/system/src/Grav/Common/Processors/InitializeProcessor.php(131): Grav\Common\Debugger->profile() #19 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Common\Processors\InitializeProcessor->process() #20 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #21 /var/www/html/system/src/Grav/Framework/RequestHandler/Middlewares/MultipartRequestSupport.php(40): Grav\Framework\RequestHandler\RequestHandler->handle() #22 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Framework\RequestHandler\Middlewares\MultipartRequestSupport->process() #23 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #24 /var/www/html/system/src/Grav/Common/Grav.php(312): Grav\Framework\RequestHandler\RequestHandler->handle() #25 /var/www/html/index.php(47): Grav\Common\Grav->process() #26 {main} [] []

[2024-01-03 08:37:07] grav.CRITICAL: syntax error, unexpected string content "Dostupne Te" - Trace: #0 /var/www/html/system/src/Grav/Common/Config/CompiledBase.php(112): Grav\Common\Config\CompiledBase->loadCompiledFile() #1 /var/www/html/system/src/Grav/Common/Service/ConfigServiceProvider.php(172): Grav\Common\Config\CompiledBase->load() #2 /var/www/html/system/src/Grav/Common/Service/ConfigServiceProvider.php(74): Grav\Common\Service\ConfigServiceProvider::languages() #3 /var/www/html/vendor/pimple/pimple/src/Pimple/Container.php(122): Grav\Common\Service\ConfigServiceProvider->Grav\Common\Service\{closure}() #4 /var/www/html/system/src/Grav/Common/Themes.php(353): Pimple\Container->offsetGet() #5 /var/www/html/system/src/Grav/Common/Themes.php(321): Grav\Common\Themes->loadLanguages() #6 /var/www/html/system/src/Grav/Common/Themes.php(64): Grav\Common\Themes->configure() #7 /var/www/html/system/src/Grav/Common/Processors/ThemesProcessor.php(35): Grav\Common\Themes->init() #8 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Common\Processors\ThemesProcessor->process() #9 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #10 /var/www/html/system/src/Grav/Common/Processors/PluginsProcessor.php(39): Grav\Framework\RequestHandler\RequestHandler->handle() #11 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Common\Processors\PluginsProcessor->process() #12 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #13 /var/www/html/system/src/Grav/Common/Processors/InitializeProcessor.php(130): Grav\Framework\RequestHandler\RequestHandler->handle() #14 /var/www/html/system/src/Grav/Common/Debugger.php(546): Grav\Common\Processors\InitializeProcessor::Grav\Common\Processors\{closure}() #15 /var/www/html/system/src/Grav/Common/Processors/InitializeProcessor.php(131): Grav\Common\Debugger->profile() #16 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Common\Processors\InitializeProcessor->process() #17 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #18 /var/www/html/system/src/Grav/Framework/RequestHandler/Middlewares/MultipartRequestSupport.php(40): Grav\Framework\RequestHandler\RequestHandler->handle() #19 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Framework\RequestHandler\Middlewares\MultipartRequestSupport->process() #20 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #21 /var/www/html/system/src/Grav/Common/Grav.php(312): Grav\Framework\RequestHandler\RequestHandler->handle() #22 /var/www/html/index.php(47): Grav\Common\Grav->process() #23 {main} [] []

[2024-01-05 10:28:21] grav.CRITICAL: syntax error, unexpected string content "Для получения �" - Trace: #0 /var/www/html/system/src/Grav/Common/Config/CompiledBase.php(112): Grav\Common\Config\CompiledBase->loadCompiledFile() #1 /var/www/html/system/src/Grav/Common/Service/ConfigServiceProvider.php(172): Grav\Common\Config\CompiledBase->load() #2 /var/www/html/system/src/Grav/Common/Service/ConfigServiceProvider.php(74): Grav\Common\Service\ConfigServiceProvider::languages() #3 /var/www/html/vendor/pimple/pimple/src/Pimple/Container.php(122): Grav\Common\Service\ConfigServiceProvider->Grav\Common\Service\{closure}() #4 /var/www/html/system/src/Grav/Common/Themes.php(353): Pimple\Container->offsetGet() #5 /var/www/html/system/src/Grav/Common/Themes.php(321): Grav\Common\Themes->loadLanguages() #6 /var/www/html/system/src/Grav/Common/Themes.php(64): Grav\Common\Themes->configure() #7 /var/www/html/system/src/Grav/Common/Processors/ThemesProcessor.php(35): Grav\Common\Themes->init() #8 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Common\Processors\ThemesProcessor->process() #9 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #10 /var/www/html/system/src/Grav/Common/Processors/PluginsProcessor.php(39): Grav\Framework\RequestHandler\RequestHandler->handle() #11 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Common\Processors\PluginsProcessor->process() #12 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #13 /var/www/html/system/src/Grav/Common/Processors/InitializeProcessor.php(130): Grav\Framework\RequestHandler\RequestHandler->handle() #14 /var/www/html/system/src/Grav/Common/Debugger.php(546): Grav\Common\Processors\InitializeProcessor::Grav\Common\Processors\{closure}() #15 /var/www/html/system/src/Grav/Common/Processors/InitializeProcessor.php(131): Grav\Common\Debugger->profile() #16 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Common\Processors\InitializeProcessor->process() #17 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #18 /var/www/html/system/src/Grav/Framework/RequestHandler/Middlewares/MultipartRequestSupport.php(40): Grav\Framework\RequestHandler\RequestHandler->handle() #19 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(50): Grav\Framework\RequestHandler\Middlewares\MultipartRequestSupport->process() #20 /var/www/html/system/src/Grav/Framework/RequestHandler/Traits/RequestHandlerTrait.php(62): Grav\Framework\RequestHandler\RequestHandler->handle() #21 /var/www/html/system/src/Grav/Common/Grav.php(312): Grav\Framework\RequestHandler\RequestHandler->handle() #22 /var/www/html/index.php(47): Grav\Common\Grav->process() #23 {main} [] []

and more.

hughbris · January 7, 2024, 11:50pm

Certainly looks dodgy. We’d love to help.

Platform? Version? Theme? Anything else you’d like to share that might help us understand so we can help you?

q3d · January 8, 2024, 12:49am

Platform: default installation Ubuntu server / Apache 2
Version: CMS Grav 1.7
Theme: Custom

After cleaning, these files are still created in cache/compiled/blueprints, cache/compiled/config, cache/compiled/language

e.g.: master-app.1inch.io.php

I noticed that when I call up the address with a subdomain, e.g. xyz.mydomain.com, the files master-xyz.mydomain.com.pl are created in these directories.
which may be because all subdomains point to the root directory. However, I don’t know where e.g. master-app.1inch.io.php comes from because it is no longer a subdomain.

I also don’t know what exactly creates these files. The owner and group are www-data.

A new file was created: master-cronos.org.php at 02:43:29.
In the logs var/log/apache2/access.log I have for 02:43:29:

45.81.20.131 - - [08/Jan/2024:02:43:29 +0000] “GET / HTTP/1.1” 200 127593 “-” “Go-http-client/1.1”

pamtbaau · January 8, 2024, 6:34am

@q3d, @hughbris,

When Grav runs, class Setup detects the domain/environment being used by the request:

github.com

getgrav/grav/blob/0d7cd64d0d9ac24579fc067550050285f5375922/system/src/Grav/Common/Config/Setup.php#L183-L194


      
          if (null === $environment) {
              if (defined('GRAV_CLI')) {
                  $request = null;
                  $uri = null;
                  $environment = 'cli';
              } else {
                  /** @var ServerRequestInterface $request */
                  $request = $container['request'];
                  $uri = $request->getUri();
                  $environment = $uri->getHost();
              }
          }

Then, during compiling/loading resourses like blueprints, config files etc. ConfigServiceProfider uses the domain name gathered by Setup to create/load domain/environment related cache files using:

github.com

getgrav/grav/blob/0d7cd64d0d9ac24579fc067550050285f5375922/system/src/Grav/Common/Service/ConfigServiceProvider.php#L104-L106


      
          $blueprints = new CompiledBlueprints($cache, $files, GRAV_ROOT);
          
          return $blueprints->name("master-{$setup->environment}")->load();

Note: "master-{$setup->environment}"

From the above, I would conclude that the Grav installation has been accessed using the domain names you are seeing in folder /cache/compiled/blueprints and others.

q3d · January 8, 2024, 8:21am

Thank you for the information. Now that I understand how files corresponding to subdomains are created with such a configured domain and server, how is it possible to gain access using a domain that points to a completely different server? There were so many files that they took up all the available space on the server’s disk and there was a problem with saving anything. Then I realized something was wrong.

pamtbaau · January 8, 2024, 8:57am

@q3d, It might be that somewhere a DNS mistake has been made by pointing a domain to your IP address. It could be these domains are being served by your hoster and the hoster has made a mistake while configuring DNS.

However, the domains your are seeing seem to be working properly,

And you are not the first who gets visitors using a different domain:

q3d · January 16, 2024, 10:12pm

I still struggle with this problem, i.e. with the files created in

I solved the domain problem and now the website reports only for the main domain. There is also one subdomain, but redirected by a DNS record to another server.

Interestingly, however, these files often have fragments of the name of this subdomain in their names.

The files differ from the original only in the timestamp value.

I do not have any information in the Apache logs about connections in which the phrase is part of the file name.

So how is it possible that these files are created?

I have disabled caching on the server. Is it normal that files are created anyway? New files also appear in the cache/complied/files directory even though the cache is disabled.

The time of creation of the files usually corresponds to this entry in access.log:

198.235.24.125 - - [17/Jan/2024:00:11:35 +0100] "GET / HTTP/1.1" 200 128165 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers&#39; presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com"

205.210.31.19 - - [17/Jan/2024:00:13:59 +0100] "GET / HTTP/1.1" 200 128281 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers&#39; presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com"

198.235.24.255 - - [17/Jan/2024:00:18:27 +0100] "GET / HTTP/1.1" 200 128145 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers&#39; presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com"

q3d · February 23, 2024, 9:39am

The problems resulted from incorrect configuration of virtual hosts on the server.

guitarmek · March 26, 2024, 2:26pm

Adding to this thread to say thanks for the analysis and to add details of the fix on my end.

Had a similar issue caused by a DNS wildcard (any subdomain would redirect to www and would therefore create a new cache file)

And a virtual host misconfiguration where the site was accessible by IP.

Once the DNS wildcard was removed and vhost configured to return 406 when accessed by IP the many cached files ceased to generate.

Topic		Replies	Views
Severe error, any clue where it comes from? Archive	13	320	January 30, 2016
Reg cache / renaming files	0	338	February 20, 2020
Twig Cache Permission Archive	23	1151	July 21, 2015
Why twice the same files with same content in config? Support	3	452	October 16, 2021
Changed root directory name lost css, images Archive	3	228	October 25, 2014

Strange files in the cache/complied/blueprints directory

Related Topics