Re: [mod-security-users] Encoding-Problems

[Harald V. <har...@un...>]

Hi,
I have still problems with special characters:

Request: ourserver requesting_ip - -=20
[05/Feb/2006:04:39:54 +0100] "GET=20
/kurse/FMPro?-db=3Durzkurse&-lay=3Dkurseweb&-format=3DSuch
_ErgebnisseT.htm&-error=3DSuchen_Fehler.htm&-sortfield=3DDatum&Themengebiet=
=3DVer%e4nderungsmanagement%20und%20Teamentwicklung&F_Abgelaufen=3D0&Gesp
errt=3Doffen&-token=3DVer%e4nderungsmanagement%2=20
HTTP/1.0" 302 230 "-" "search.ch V1.4.2=20
(spi...@se...; http://www.search.ch)" - "-"
Handler: proxy-server
----------------------------------------
GET=20
/kurse/FMPro?-db=3Durzkurse&-lay=3Dkurseweb&-format=3DSuch_ErgebnisseT.htm&-=
error=3DSuchen_Fehler.htm&-sortfield=3DDatum&Themengebiet=3DVer%e4nderun
gsmanagement%20und%20Teamentwicklung&F_Abgelaufen=3D0&Gesperrt=3Doffen&-toke=
n=3DVer%e4nderungsmanagement%2=20
HTTP/1.0
Accept: text/html, text/plain,*
Accept-Language: de,fr,it,en,*
mod_security-message: Access denied with code=20
400. Error normalising REQUEST_URI: Invalid URL=20
encoding detected: not enough characters

httpd.conf settings for this virtual host:

SecFilterCheckURLEncoding On
SecFilterCheckUnicodeEncoding Off
SecFilterForceByteRange 1 255

Any help?

Kind regards,
Harald


At 21:42 02.02.2006, Ivan Ristic wrote:
>Harald Volz wrote:
> > Hi
> > I am using the last version (1.9.2) and have problems with the german
> > "umlaut" and other special charactes in URL and other Headerparts.
>
>
> > SecFilterCheckUnicodeEncoding On
>
>   SecFilterCheckUnicodeEncoding should be "off" in your case.
>
>
> > Header Problem 2: strange Agent coming from japanese site....
> > Request: ourserver requestor - - [01/Feb/2006:11:18:10 +0100] "GET
> > /favicon.ico HTTP/1.0" 302 230 "-" "\xf0\x05\xe1\x07X9\xb
> > 5\x05\x08" - "-"
> > User-Agent: =F0^E=E1^GX9=B5^
> > mod_security-message: Access denied with code 400. Error validating
> > header value (User-Agent): Invalid character detected [5]
>
>   This message is not consistent with "SecFilterForceByteRange 1 255",
>   ie should not happen. Did you use a different configuration when
>   you got that error?
>
>--
>Ivan Ristic, Technical Director
>Thinking Stone, http://www.thinkingstone.com

------------------------------------------------------------------------
Harald Volz                                 har...@un...
Universitaetsrechenzentrum                  Tel: (++41) (0) 61 267 22 67
Universitaet Basel                          Fax: (++41) (0) 61 267 22 82
Klingelbergstr. 70
CH-4056 Basel
------------------------------------------------------------------------