Re: multipart/form-data

Rude Yak wrote:
> Greetings, mod_security gurus.  I have a question about protecting a CGI that
> accepts file uploads.  I have a rule that I'm using to protect the various 
> form
> variables:
> 
> SecFilterSelective "ARGS" "!^[A-Za-z0-9.&/?@_%=:;, -]*$"
> 
> ...
> 
> What's the correct mod_security way to do this?

  You are already doing it correctly but you encountered a
  mod_security bug. To avoid the problem you have just described,
  the ARGS variable is not supposed to work against a raw payload
  when multipart/form-data encoding is used.

  I have now fixed the bug (committed to the CVS a minute
  ago). If you continue to experience problems do let me know.

  You can download the new version from the CVS here (although
  it still doesn't show as I am writing this - you want 1.8.4RC3):

  http://cvs.sourceforge.net/viewcvs.py/mod-security/mod_security/

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]




-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click