Bad UTF-8 in GET body

[ntalbott]

The HTTP spec allows a GET body, and Rails violates the intent of the spec by parsing that body. Unfortunately this means that a poorly behaved bot (looking at you, EasuoSpider) that submits bad UTF-8 in a GET body throws exceptions even with utf8_sanitizer in place, since the sanitizer does not sanitize rack.input on GET.

For now I've fixed this locally via a custom middleware that just kills rack.input (by assigning StringIO.new) if the request is a GET, but I'm wondering if utf8_sanitizer should go ahead and sanitize rack.input on all requests, since the spec allows a body for all request types and someone out there could be relying on Rails parsing the body for GET.

Happy to submit a PR if you think this is a good idea, but I wanted to check first since I'm not sure what the overhead is on the IO sanitization.

[whitequark]

I definitely think it is a good idea.