[mod-security-users] Encoding-Problems

[Harald V. <har...@un...>]

Hi
I am using the last version (1.9.2) and have=20
problems with the german "umlaut" and other=20
special charactes in URL and other Headerparts.
To fix this I added
SecFilterCheckURLEncoding On
SecFilterCheckUnicodeEncoding On
SecFilterForceByteRange 1 255
but this does not help as shown below
Any hints?
Regards
Harald

URL-Problem 1 (umlaut =F6 in URL)
Request: ourserver requestor - -=20
[02/Feb/2006:13:48:55 +0100] "GET=20
/pictures/m%F6nche.jpg HTTP/1.1" 302 230=20
"http://ourserver/photoarch.html" "Mozilla/4.0=20
(compatible; MSIE 5.0; Windows 98; DigExt)" - "-"
Handler: proxy-server
----------------------------------------
GET /pictures/m%F6nche.jpg HTTP/1.1
mod_security-message: Access denied with code=20
400. Error normalising REQUEST_URI: Invalid=20
Unicode encoding: invalid byte value
mod_security-action: 400
Content-Type: text/html; charset=3Diso-8859-1

URL-Problem 2 (umlaut =E4 in URL, Spaces)
----------------------------------------
GET=20
/kurse/FMPro?-db=3Durzkurse&-lay=3Dkurseweb&-format=3DSuch_ErgebnisseT.htm&-=
error=3DSuchen_Fehler.htm&-sortfield=3DDatum&Themengebiet=3DInterdisziplin%e=
4res%20Lernen&F_Abgelaufen=3D0&Gesperrt=3Doffen&-token=3DInterdisziplin%e4re=
s%20Lernen&-find=20
HTTP/1.1
mod_security-message: Access denied with code=20
400. Error normalising REQUEST_URI: Invalid=20
Unicode encoding: invalid byte value
Content-Type: text/html; charset=3Diso-8859-1

Header-Problem1: (umlaut =FC in Useragent)
Request: ourserver requestor  - -=20
[02/Feb/2006:11:34:10 +0100] "GET /some.pdf HTTP/1.0" 30
2 230=20
"http://www.google.de/search?hl=3Dde&q=3DZyklisch+Phosphorylierung&spell=3D1=
"=20
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT=20
5.1; Schiller-Gymnasium Sch\xfcler; Schiller-=20
Gymnasium Lehrer; .NET CLR 1.0.3705)" - "-"
Handler: proxy-server
----------------------------------------
GET /some.pdf HTTP/1.0
Via: 1.0 S4
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0;=20
Windows NT 5.1; Schiller-Gymnasium Sch=FCler;=20
Schiller- Gymnasium Lehrer; .NET CLR 1.0.3705)
Host: ourserver
mod_security-message: Access denied with code=20
400. Error validating header value (User-Agent):=20
Invalid Unicode encoding: invalid byte value
Content-Type: text/html; charset=3Diso-8859-1

Header Problem 2: strange Agent coming from japanese site....
Request: ourserver requestor - -=20
[01/Feb/2006:11:18:10 +0100] "GET /favicon.ico=20
HTTP/1.0" 302 230 "-" "\xf0\x05\xe1\x07X9\xb
5\x05\x08" - "-"
User-Agent: =F0^E=E1^GX9=B5^
mod_security-message: Access denied with code=20
400. Error validating header value (User-Agent): Invalid character detected=
 [5]