mod-security-users

[mod-security-users] mod_security can't filter some words :(

[<hao...@gm...>]

aGkKaSB1c2UgbW9kX3NlY3VyaXR5IDEuOS4yIGFuZCBodHRwZCAyLjAuNTUgdGVzdCBzb21lIHBo
cCBzb2Z0d2FyZSAuCm9uIHNvbWUgY2FzZSBpIG5lZWQgZmlsdGVyIGNoaW5hZXNlIHdvcmQgaW4g
d2ViIHNvZnR3YXJlIC4KZm9yIGV4YW1wbGUKU2VjRmlsdGVyU2VsZWN0aXZlIFBPU1RfUEFZTE9B
RCDW0M7EClNlY0ZpbHRlclNlbGVjdGl2ZSBQT1NUX1BBWUxPQUQgdGVzdGEKaXMgIlNlY0ZpbHRl
clNlbGVjdGl2ZSBQT1NUX1BBWUxPQUQgdGVzdGEgIiBpcyBwYXNzIC5idXQgU2VjRmlsdGVyU2Vs
ZWN0aXZlClBPU1RfUEFZTE9BRCDW0M7EIGlzIG5vdCA6KAoKdGhpcyBsb2cgaXMgZm9yIHRlc3Rh
IDoKPT0yOWFlNTMzOT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQpSZXF1ZXN0OiAxOTIu
MTY4LjIwMi40NyAyMTEuMTU3LjIyNy4yOSAtIC0gWzAzL0Fwci8yMDA2OjE0OjM4OjQ1ICswODAw
XQoiUE9TVCAvNy9wb3N0LnBocD9hY3Rpb249cmVwbHkmZmlkPTImdGlkPTQmZXh0cmE9cGFnZSUz
RDEmcmVwbHlzdWJtaXQ9eWVzCkhUVFAvMS4xIiA0MDMgMjg3ICIKaHR0cDovLzE5Mi4xNjguMjAy
LjQ3LzcvcG9zdC5waHA/YWN0aW9uPXJlcGx5JmZpZD0yJnRpZD00JmV4dHJhPXBhZ2UlM0QxIgoi
TW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNS4xOyB6aC1DTjsgcnY6MS44LjAu
MSkgR2Vja28vMjAwNjAxMTEKRmlyZWZveC8xLjUuMC4xIiAtICItIgotLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tClBPU1QgLzcvcG9zdC5waHA/YWN0aW9uPXJlcGx5JmZp
ZD0yJnRpZD00JmV4dHJhPXBhZ2UlM0QxJnJlcGx5c3VibWl0PXllcwpIVFRQLzEuMQpIb3N0OiAx
OTIuMTY4LjIwMi40NwpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93czsgVTsgV2luZG93
cyBOVCA1LjE7IHpoLUNOOyBydjoxLjguMC4xKQpHZWNrby8yMDA2MDExMSBGaXJlZm94LzEuNS4w
LjEKQWNjZXB0OiB0ZXh0L3htbCxhcHBsaWNhdGlvbi94bWwsYXBwbGljYXRpb24veGh0bWwreG1s
LHRleHQvaHRtbDtxPTAuOQosdGV4dC9wbGFpbjtxPTAuOCxpbWFnZS9wbmcsKi8qO3E9MC41CkFj
Y2VwdC1MYW5ndWFnZTogemgtY24semg7cT0wLjUKQWNjZXB0LUVuY29kaW5nOiBnemlwLGRlZmxh
dGUKQWNjZXB0LUNoYXJzZXQ6IGdiMjMxMix1dGYtODtxPTAuNywqO3E9MC43CktlZXAtQWxpdmU6
IDMwMApDb25uZWN0aW9uOiBrZWVwLWFsaXZlClJlZmVyZXI6Cmh0dHA6Ly8xOTIuMTY4LjIwMi40
Ny83L3Bvc3QucGhwP2FjdGlvbj1yZXBseSZmaWQ9MiZ0aWQ9NCZleHRyYT1wYWdlJTNEMQpDb29r
aWU6IGNkYl9zaWQ9NjVGMVk2OyBjZGJfb2xkdG9waWNzPUQ0RDNEMkQxRDsgY2RiX2ZpZDE9MTE0
NDA0NDg3MjsKY2RiX2Nvb2tpZXRpbWU9MjU5MjAwMDsgY2RiX2NwY29sbGFwc2VkPTA7IGNkYl9m
aWQyPTExNDQwNDYyOTM7CmNkYl92aXNpdGVkZmlkPTI7IGNkYl9hdXRoPVVGSUhVQXBSVUFnSFZR
d0VBRk1DRGd4V1hGc0VVRlpSVVZZUEJRUUhWQUZyYWdRCkNvbnRlbnQtVHlwZTogbXVsdGlwYXJ0
L2Zvcm0tZGF0YTsKYm91bmRhcnk9LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tNTE1MDk0ODEx
MzAxMQpDb250ZW50LUxlbmd0aDogNDI1Mgptb2Rfc2VjdXJpdHktYWN0aW9uOiA0MDMKbW9kX3Nl
Y3VyaXR5LW1lc3NhZ2U6IEFjY2VzcyBkZW5pZWQgd2l0aCBjb2RlIDQwMy4gUGF0dGVybiBtYXRj
aCAidGVzdGEiIGF0ClBPU1RfUEFZTE9BRAoKCgoKCnNvIGlmICB5b3UgaGF2ZSBzb21lIHRpcHMg
LnBscyBtYWlsIHRvIHRoaXMgbWFpbCBsaXN0IC4KdGhhbmsgeW91Ci0tCmh0dHA6Ly93YW5naGFv
LmN1YmxvZy5jbgo=

Re: [mod-security-users] mod_security can't filter some words :(

[Ivan R. <iv...@we...>]

=CE=D2=B0=AE=B3=F4=B6=B9=B8=AF wrote:
> hi
> i use mod_security 1.9.2 and httpd 2.0.55 test some php software .
> on some case i need filter chinaese word in web software .
> for example
> SecFilterSelective POST_PAYLOAD =D6=D0=CE=C4
> SecFilterSelective POST_PAYLOAD testa
> is "SecFilterSelective POST_PAYLOAD testa " is pass .but
> SecFilterSelective POST_PAYLOAD =D6=D0=CE=C4 is not :(

  That may be caused by the differences in the encodings
  used to define the signature and to enter the content.

  Can you send me (to my private email address) your raw
  (binary) audit log entry and I'll see if I can do anything
  about it.

--=20
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net