Re: Request content encoding is not allowed bypolicy - false positive?

UPDATE: A new build of the core rule set, 1.3.2 build 3, is available
for download at http://www.modsecurity.org/download/index.html

The new build fixes this bug. This is the only change in the new build.

~ Ofer
ModSecurity Core Rule Set Project Leader

> -----Original Message-----
> From: Ofer Shezaf
> Sent: Wednesday, January 10, 2007 12:46 AM
> To: 'Edy'; mod-security-users@xxxxxxxxxxxxxxxxxxxxx
> Subject: RE: [mod-security-users] Request content encoding is not
allowed
> bypolicy - false positive?
> 
> 
> It seems that there are unneeded end of line symbols in the regular
> expression. The correct regular expression for the 2nd rule in chain
id
> 960010 (file #30) sould be:
> 
> "!(?:^(?:application/x-www-form-urlencoded$|multipart/form-
> data;)|text/xml)"
> 
> I will run some more tests and will issues a new build to the core
rule
> set tomorrow.
> 
> Thanks
> ~ Ofer
> Core Rule Set Project Leader
> 
> 
> > -----Original Message-----
> > From: mod-security-users-bounces@xxxxxxxxxxxxxxxxxxxxx [mailto:mod-
> > security-users-bounces@xxxxxxxxxxxxxxxxxxxxx] On Behalf Of Edy
> > Sent: Tuesday, January 09, 2007 6:33 AM
> > To: mod-security-users@xxxxxxxxxxxxxxxxxxxxx
> > Subject: [mod-security-users] Request content encoding is not
allowed
> > bypolicy - false positive?
> >
> > Good Day
> >
> > ModSecurity v2.1.0-rc5 (Apache 2.x)
> > modsecurity-core-rules_2.1-1.3.2b2.tar.gz
> >
> > I am getting the following flagged. Any idea why the request is
illegal?
> > The request is legal since the user was trying to submit a form
mail.
> >
> > Thanks,
> > Edy
> >
> > --a780dd30-A--
> > [09/Jan/2007:12:22:30 +0800] 5PorMn8AAAEAAEu9NJoAAAAP 202.232.182.71
> > 63523 10.10.10.20 80
> > --a780dd30-B--
> > POST /downloads/contactus/HarksMailer.php HTTP/1.0
> > Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
> > application/vnd.ms-powerpoint, application/vnd.ms-excel,
> > application/msword, application/x-shockwave-flash, */*
> > Referer: http://www.bigpond.com.sg/downloads/digi_email.htm
> > Accept-Language: en-us
> > Content-Type: multipart/form-data;
> > boundary=---------------------------7d7d9c1e070c
> > User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
.NET
> > CLR 1.1.4322; .NET CLR 2.0.50727)
> > Content-Length: 1423
> > Pragma: no-cache
> > Via: 1.0 s-1.proxy2.mnt.b1600a.bigpond.co.jp:8080
(squid/2.5.STABLE5),
> > 1.0 outweb2.bigpond.co.jp:3128 (Squid/2.4.STABLE2)
> > X-Forwarded-For: unknown, unknown
> > Host: www.bigpond.com.sg
> > Cache-Control: max-age=259200
> > Connection: keep-alive
> >
> > --a780dd30-F--
> > HTTP/1.1 501 Method Not Implemented
> > Allow: TRACE
> > Content-Length: 241
> > Connection: close
> > Content-Type: text/html; charset=iso-8859-1
> >
> > --a780dd30-H--
> > Message: Access denied with code 501 (phase 1). Match of "rx
> > ^(?:^(?:application/x-www-form-urlencoded$|multipart/form-
> > data;)|text/xml)$"
> > against "REQUEST_HEADERS:Content-Type" required. [id "960010"] [msg
> > "Request content encoding is not allowed by policy"] [severity
> "WARNING"]
> > Action: Intercepted (phase 1)
> > Stopwatch: 1168316550490930 800 (- - -)
> > Producer: ModSecurity v2.1.0-rc5 (Apache 2.x)
> > Server: Apache/2.0.52 (CentOS)
> >
> > --a780dd30-Z--
> >
> >
------------------------------------------------------------------------
> -
> > Take Surveys. Earn Cash. Influence the Future of IT
> > Join SourceForge.net's Techsay panel and you'll get the chance to
share
> > your
> > opinions on IT & business topics through brief surveys - and earn
cash
> >
>
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDE
V
> > _______________________________________________
> > mod-security-users mailing list
> > mod-security-users@xxxxxxxxxxxxxxxxxxxxx
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV