mod_security

[Pumazooma]

I've just had an interesting afternoon trying to sort out a problem on my forum. Having now fixed it I'd like to know if someone can tell me why the answer is what it is.

I run a phpBB forum and had a user who was having problems sending a PM. It looked like a fairly standard message but each time he tried to send it he got

Not Acceptable
An appropriate representation of the requested resource /forum/privmsg.php could not be found on this server.

I tried sending it too and had no luck despite test messages working.

After consulting an online operator who assured me it wasn't a server issue I did some reading around and found out it's related to a server side application called mod_security which has a list of disallowed words or characters (for security reasons).

After chopping the PM up into sections and test sending it, I managed to narrow it down to one single character that was causing the problem.

é

The message contained the word coupé.

So, my question is, why is é such a major security problem to be on a disallowed list?

[Pumazooma]

No one got an answer for this?

[Administrator]

Hello Pumazooma,

We have customized rules in mod_security on our server and most of the commands that are executed by guys running exploits from browser are turned off in mod_security. There must have been something in your private message which was turned off in mod_security. If you can let me know the exact time you will be trying same message then I can check the logs on the server and make out which word is getting blocked in mod_security.

[Prince of Cats]

The é character exists outside the basic characters. (I am not sure of it's ASCII or UNICODE values) I would assume that mod_security bans all non-standard characters from strings just to ensure that you can't break any applications it is protecting. Personally, I find that PHP is fairly robust and the escape() function does a very good job on its own but you can never guess what might break a proprietary application because you don't know what characters they might use for delimiters, so the safest bet would be to only allow a-z, A-Z, 0-9 and the common special characters.

That is my guess...