Mod Security Tiggered by Invision Power Board Emoticons

[Scott Adams]

I recently upgraded my Invision Power Board forum to their latest 4.x version, and now have an issue with my Mod Security rules--specifically the use of emoticons in a post on my board now triggers Mod Security and 406 blocks users. I've done some research on this, and am hoping you can help me find a solution--if so could you please post it here?

Here is the info I have:

1) The Mod Security warning I get:
[msg "Cross-site Scripting (XSS) Attack"]

2) The specific piece of code that seems to trigger it which is included in the warning:
[data "src\x22:\x22http:"]

3) After opening a ticket with Invision they told me that the specific way of calling the emoticons is probably the actual trigger (see the line below), but that they can't help me figure out how to tweak my rules to allow it:
[{"src":"//community.invisionpower.com/uploads/emoticons/tongue.png","text":":tongue:"}]

4) And now for the hard part, here are my XSS Mod Security Rules...can anyone tell me how to modify them so that this won't happen anymore? Obviously taking out the entire rule is what I had to do for now, but what I am really seeking here is just removing the one part of this rule that is causing the block:

[code]# XSS
SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/|!REQUEST_HEADERS:Referer "@pm jscript onsubmit copyparentfolder javascript meta onmove onkeydown onchange onkeyup activexobject expression onmouseup ecmascript onmouseover vbscript: <![cdata[ http: settimeout onabort shell: .innerhtml onmousedown onkeypress asfunction: onclick .fromcharcode background-image: .cookie ondragdrop onblur x-javascript mocha: onfocus javascript: getparentfolder lowsrc onresize @import alert onselect script onmouseout onmousemove background application .execscript livescript: getspecialfolder vbscript iframe .addimport onunload createtextrange onload <input" \ "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,pass,nolog,skip:1,id:1234123406"
SecAction phase:2,pass,nolog,skipAfter:1234123449,id:1234123405
SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES "(?:\b(?:(?:type\b\W?\b(?:text\b\W?\b(?:j(?:ava)?|ecma|vb)|application\b\W?\bx-(?:java|vb))script|c(?:opyparentfolder|reatetextrange)|get(?:special|parent)folder|iframe\b.{0,100}?\bsrc)\b|on(?:(?:mo(?:use(?:o(?:ver|ut)|down|move|up)|ve)|key(?:press|down|up)|c(?:hange|lick)|s(?:elec|ubmi)t|(?:un)?load|dragdrop|resize|focus|blur)\b\W?=|abort\b)|(?:l(?:owsrc\b\W?\b(?:(?:java|vb)script|shell|http)|ivescript)|(?:href|url)\b\W?\b(?:(?:java|vb)script|shell)|background-image|mocha):|s(?:(?:tyle\b\W=.\bexpression\b\W|ettimeout\b\W?)(|rc\b\W?\b(?:(?:java|vb)script|shell|http):)|a(?:ctivexobject\b|lert\b\W?(|sfunction:))|<(?:(?:body\b.?\b(?:backgroun|onloa)d|input\b.?\btype\b\W?\bimage)\b| ?(?:(?:script|meta)\b|iframe)|![cdata[)|(?:.(?:(?:execscrip|addimpor)t|(?:fromcharcod|cooki)e|innerhtml)|\@import)\b)" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'Cross-site Scripting (XSS) Attack',id:'1234123404',tag:'WEB_ATTACK/XSS',logdata:'%{TX.0}',severity:'2'"
SecRule REQUEST_HEADERS|XML:/|!REQUEST_HEADERS:Referer "(?:\b(?:(?:type\b\W?\b(?:text\b\W?\b(?:j(?:ava)?|ecma|vb)|application\b\W?\bx-(?:java|vb))script|c(?:opyparentfolder|reatetextrange)|get(?:special|parent)folder|iframe\b.{0,100}?\bsrc)\b|on(?:(?:mo(?:use(?:o(?:ver|ut)|down|move|up)|ve)|key(?:press|down|up)|c(?:hange|lick)|s(?:elec|ubmi)t|(?:un)?load|dragdrop|resize|focus|blur)\b\W?=|abort\b)|(?:l(?:owsrc\b\W?\b(?:(?:java|vb)script|shell|http)|ivescript)|(?:href|url)\b\W?\b(?:(?:java|vb)script|shell)|background-image|mocha):|s(?:(?:tyle\b\W=.\bexpression\b\W|ettimeout\b\W?)(|rc\b\W?\b(?:(?:java|vb)script|shell|http):)|a(?:ctivexobject\b|lert\b\W?(|sfunction:))|<(?:(?:body\b.?\b(?:backgroun|onloa)d|input\b.?\btype\b\W?\bimage)\b| ?(?:(?:script|meta)\b|iframe)|![cdata[)|(?:.(?:(?:execscrip|addimpor)t|(?:fromcharcod|cooki)e|innerhtml)|\@import)\b)" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'Cross-site Scripting (XSS) Attack',id:'1234123449',tag:'WEB_ATTACK/XSS',logdata:'%{TX.0}',severity:'2'"
Command access
SecRule REQUEST_FILENAME "\b(?:n(?:map|et|c)|w(?:guest|sh)|cmd(?:32)?|telnet|rcmd|ftp).exe\b" \ "phase:2,capture,t:none,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'System Command Access',id:'1234123399',tag:'WEB_ATTACK/FILE_INJECTION',logdata:'%{TX.0}',severity:'2'"

[/code]