[mod-security-users] problem with SecFilter "<(.|\n)+>"

[Thomas <tb...@tb...>]

Hi List,

I've a problem with the following URL:

http://www.domain.de/module/lauftext.swf?text=%3Cb%3ENeu%3A+F%C3%B6rder-
+und+Siebrinnen+VCS%3C%2Fb%3E+-+Sch%C3%BCttg%C3%BCter+kostensparend
+transportieren&link=verfahrenstechnik%2Frinnen%2Fvcs%2F%3Fde

the debug shows

[09/Mar/2005:22:53:17 +0100]
[www.domain.de/sid#8269140][rid#830cd88][/module/lauftext.swf] Signature
check returned 0
[09/Mar/2005:22:53:17 +0100]
[www.domain.de/sid#8269140][rid#830cd88][/module/lauftext.swf] Checking
signature "<(.|\\n)+>" at THE_REQUEST
[09/Mar/2005:22:53:17 +0100]
[www.domain.de/sid#8269140][rid#830cd88][/module/lauftext.swf] Checking
against "/module/lauftext.swf?text=<b>Neu: F\xc3\xb6rder- und Siebrinnen
VCS</b> - Sch\xc3\xbcttg\xc3\xbcter kostensparend
transportieren&link=verfahrenstechnik/rinnen/vcs/?de"
[09/Mar/2005:22:53:17 +0100]
[www.domain.de/sid#8269140][rid#830cd88][/module/lauftext.swf] Signature
check returned 500
[09/Mar/2005:22:53:17 +0100]
[www.domain.de/sid#8269140][rid#830cd88][/module/lauftext.swf] Access
denied with code 500. Pattern match "<(.|\\n)+>" at THE_REQUEST
[09/Mar/2005:22:53:17 +0100]
[www.domain.de/sid#8269140][rid#830cd88][/module/lauftext.swf] Rule
match, returning code 500

i found no "." and no "\n" in the URL. Why matches mod_security
this URL by this Rule ?

Many thanks for help.

-Thomas