RE: [Modsecurity] Access denied with code 406. Pattern match "\|*\x20*\x20*\|" atTHE_REQUEST

> -----Original Message-----
> From: Sander Holthaus - Orange XL [mailto:info@xxxxxxxxxxxx] 
> Sent: Friday, August 05, 2005 1:48 PM
> To: 'Bill Church'
> Cc: mod-security-users@xxxxxxxxxxxxxxxxxxxxx
> Subject: RE: [Modsecurity] Access denied with code 406. 
> Pattern match "\|*\x20*\x20*\|" atTHE_REQUEST
> > To me, this would be spelled out as
> > 
> >  \| (pipe) * (anything) \x20 (space) * (anything) \x20
> > (space) * (anything) \| (pipe)
> 
> Not entirely. It spells:
> 
> Zero to infinite (pipe) Zero to infinite (space) Zero to 
> infinite (space)
> (pipe)
> 
> Which will match anything with a single pipe in. Therefore it 
> also reads as:
> 
> SecFilterSelective THE_REQUEST "\|"
> 
> Use + instead of *.
> 
> Kind regards,
> Sander Holthaus
> 

You're right, that's actually what I meant by that, sorry. In any case I
think that rule is probably too catchy? I'm not sure of it's original
intention though, it me be acting as intended which is fine if it is.

-Bill



-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf