mod-security-users

[mod-security-users] Unicode problem.

[Thierry R. <tr...@ri...>]

Hi,

I just enable SecFilterCheckUnicodeEncoding and mod_sec(1.8.6) seem to see=
=20
invalid unicode encoding in this referer:
"http://search.ke.voila.fr/S/wanadoo?gb=3Dsite&dt=3D*&cid=3Dwng&kw=3Ddiversi=
t%E9%20culturel"

but there is no unicode in it, only url encoding characters.

Any idea?

Thanks
Thierry
##
part of my conf:

SecFilterScanPOST On
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat On
SecFilterCheckUnicodeEncoding On
SecFilterForceByteRange 1 255
###
part of the log:

GET / HTTP/1.1
Accept: */*
Referer:=20
http://search.ke.voila.fr/S/wanadoo?gb=3Dsite&dt=3D*&cid=3Dwng&kw=3Ddiversit=
%E9%20culturel
Accept-Language: en-ca,en-us;q=3D0.7,fr-ca;q=3D0.3
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: www.something.com
Connection: Keep-Alive
mod_security-message: Error validating header value (Referer): Invalid=20
Unicode encoding: invalid byte value
mod_security-action: 403
#######


Toujours le premier =E0 vous offrir la gamme compl=E8te de services Internet=
 de=20
classe affaires, depuis 1994.

Thierry Robitaille
Responsable du Support Technique, Administrateur UNIX et NT

Registraire agr=E9=E9 par:  L'Autorit=E9 canadienne pour les enregistrements=
=20
internet.

URL : http://www.riq.qc.ca
T=E9l=E9phone :     (418) 521-2884  Qu=E9bec
                 (514) 875-5351  Montr=E9al=20

Re: [mod-security-users] Unicode problem.

[Ivan R. <iv...@we...>]

Thierry Robitaille wrote:
> Hi,
> 
> I just enable SecFilterCheckUnicodeEncoding and mod_sec(1.8.6) seem to 
> see invalid unicode encoding in this referer:
> "http://search.ke.voila.fr/S/wanadoo?gb=site&dt=*&cid=wng&kw=diversit%E9%20culturel" 
> 
> but there is no unicode in it, only url encoding characters.
> 
> Any idea?

   In short: if there's no Unicode there then Unicode encoding
   validation won't do any good for you. It will just produce false
   positives, such as the one you used as the example. Therefore you
   need to turn it off.

   ModSecurity can't tell (because HTTP does not support it) whether some
   incoming data is Unicode or not. Therefore it's on you to decide
   whether to enable the validation feature or not, using the knowledge
   of your application. If the Unicode encoding validation feature is
   enabled then all data must be a valid UTF-8 encoding. In your example,
   the %e9 character is treated as the first of a three-byte UTF-8
   encoded character. ModSecurity complains because the second and the
   third bytes are not valid.

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Unicode problem.

[Ivan R. <iv...@we...>]

Thierry Robitaille wrote:
> Hi,
> 
> Ok, but I have 1 vhost that use UTF-8 has default ("AddDefaultCharset 
> UTF-8"), is there a way to enable it just for this one?
> 
> The rest of my mod_sec conf and rules are apply to all my vhosts.

   Of course. Disable it globally and only enable it for that
   virtual host (inside the <VirtualHost> container).

-- 
Ivan Ristic (http://www.modsecurity.org)