handle ViewNotCallableError as 404

CHANGES.rst

@@ -13,7 +13,7 @@ https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
 - Enable ZMI History tab for ``OFS.Image.File``.
   (`#396 <https://github.com/zopefoundation/Zope/pull/396>`_)
 
-- Fix error messages from spam/pen test requests.
+- Fix requests from spam/pentests to return BadRequest/400 errors
 
 - Fix a ``ResourceWarning`` emitted when uploading large files.
   (`#1242 <https://github.com/zopefoundation/Zope/issues/1242>`_)

src/ZPublisher/BaseRequest.py

@@ -469,8 +469,12 @@ def traverse(self, path, response=None, validated_hook=None):
                             # Zope2 doesn't set up its own adapters in a lot
                             # of cases so we will just use a default adapter.
                             adapter = DefaultPublishTraverse(object, self)
-
-                    object, default_path = adapter.browserDefault(self)
+                    try:
+                        object, default_path = adapter.browserDefault(self)
+                    except NotImplementedError:
+                        return response.badRequestError(
+                            "View is not callable. Traverse more."
+                        )
                     if default_path:
                         request._hacked_path = 1
                         if len(default_path) > 1: