Re: Please help with converting this filtering rules to mod_security2

Camelia,

What are you trying to achieve with these rules?  It appears that you are trying to block all _javascript_ from being sent out from the web server.  Is this the case?  Does your web application use any _javascript_ at all?  If so, then these rules would block legitimate _javascript_ as well as malicious _javascript_.  If your site does not use _javascript_ at all, then I suppose you could use a rule like this.

 

--
Ryan C. Barnett
Breach Security: Director of Application Security Training
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor, GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
Author: Preventing Web Attacks with Apache

 

---

From: mod-security-users-bounces@xxxxxxxxxxxxxxxxxxxxx [mailto:mod-security-users-bounces@xxxxxxxxxxxxxxxxxxxxx] On Behalf Of Williams, Camelia (HQP)
Sent: Tuesday, January 09, 2007 7:08 PM
To: mod-security-users@xxxxxxxxxxxxxxxxxxxxx
Subject: [mod-security-users] Please help with converting this filtering rules to mod_security2

 

SecFilteringScanOutput On

 SecFilterOutput OUTPUT "_javascript_:" "deny, status:500"

 SecFilterOutput OUTPUT "<\s*script.*?\s*>" "deny, status:500"

 

Thanks

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV_______________________________________________
mod-security-users mailing list
mod-security-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/mod-security-users