mod-security-users

[mod-security-users] "invalid unicode"?

[Mark <ad...@as...>]

Hmm, just found this in my mod_security log:

--------------------------------------------
GET /spf/sendmail-milter-spf.pl HTTP/1.0
Accept: */*
Accept-Language: fr-ch
Cache-Control: max-age=3D259200
Connection: keep-alive
Host: srs-socketmap.info
Referer: http://spf.pobox.com/downloads.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; =
Fran=E7ais 2.2;
..NET CLR 1.1.4322)
Via: 1.0 zante.efg.ch:3128 (squid/2.5.STABLE5-20040628)
X-Forwarded-For: 10.60.11.239, 127.0.0.1
mod_security-message: Access denied with code 406. Error validating =
header
value (User-Agent): Invalid Unicode encoding: invalid byte value
--------------------------------------------

What is with the "invalid unicode"? That was a perfectly legit
request, as far as I can tell. If not a bug, then why does
this occur?

Thanks,

- Mark

Re: [mod-security-users] "invalid unicode"?

[Ivan R. <iv...@we...>]

> What is with the "invalid unicode"? That was a perfectly legit
> request, as far as I can tell. If not a bug, then why does
> this occur?

 > User-Agent: ... Fran=E7ais 2.2;

   It's this character ^ here that causes problems. You need to
   turn Unicode validation off. Characters over 0x7f have a special
   meaning in Unicode...

--=20
Ivan Ristic (http://www.modsecurity.org)

RE: [mod-security-users] "invalid unicode"?

[Mark <ad...@as...>]

> -----Original Message-----
> From: mod...@li...=20
> [mailto:mod...@li...] On=20
> Behalf Of Ivan Ristic
> Sent: donderdag 3 februari 2005 17:19
> To: Mark
> Cc: mod...@li...
> Subject: Re: [mod-security-users] "invalid unicode"?
>=20
>=20
> > What is with the "invalid unicode"? That was a perfectly legit
> > request, as far as I can tell. If not a bug, then why does
> > this occur?
>=20
>  > User-Agent: ... Fran=E7ais 2.2;
>=20
>    It's this character ^ here that causes problems. You need to
>    turn Unicode validation off. Characters over 0x7f have a special
>    meaning in Unicode...

Is there not a way I can disable unicode checking just for User-Agent?
I doubt I am the only server who receives requests from France or
other countries with such characters in it.

Thanks.

- Mark

Re: [mod-security-users] "invalid unicode"?

[Ivan R. <iv...@we...>]

Mark wrote:
>>>What is with the "invalid unicode"? That was a perfectly legit
>>>request, as far as I can tell. If not a bug, then why does
>>>this occur?
>>
>> > User-Agent: ... Fran=E7ais 2.2;
>>
>>   It's this character ^ here that causes problems. You need to
>>   turn Unicode validation off. Characters over 0x7f have a special
>>   meaning in Unicode...
>=20
>=20
> Is there not a way I can disable unicode checking just for User-Agent?

   No, not yet. But as a rule of thumb Unicode checking should always
   be disabled by default and only enabled for applications that
   use Unicode. If you don't do this you are bound to get false
   positives from time to time.

--=20
Ivan Ristic (http://www.modsecurity.org)