up vote 0 down vote favorite
share [g+] share [fb]

I'm getting a Modsecurity warning that I think is a false alarm but maybe I'm not understanding what I'm looking at. Here is the log:

ModSecurity: Warning. Pattern match "(?i:^text/html;?$)" at RESPONSE_CONTENT_TYPE. [file >"/etc/apache2/modsecurity-rules/modsecurity_crs_55_application_defects.conf"] [line "18"] >[id "981220"] [msg "Character Set (Charset) Not Specified for Response Content."] [data >"text/html"] [tatag "WASCTC/WASC-15"] [tag "MISCONFIGURATION"] [tag >"http://code.google.com/p/browsersec/wiki/Part1#Hypertext_Markup_Language"] [hostname >"blahblahblah.com"] [uri "/wp-includes/js/tinymce/plugins/wpeditimage/editimage.html"]

ModSecurity: Warning. Match of "rx "RESPONSE_BODY" required. [file "/etc/apache2/modsecurity- >rules/modsecurity_crs_55_application_defects.conf"] [line "25"] [id "981222"] [msg >"Charset not explicitly set to UTF-8 in Content-Type or HTML/XML content"] [data >"Content-Type Header: text/html"] [tag "WASCTC/WASC-15"] [tag "MISCONFIGURATION"] [tag >"http://websecuritytool.codeplex.com/wikipage?title=Checks#charset-not-utf8"] [hostname >"blahblahblah.com"] [uri "/wp-includes/js/tinymce/plugins/wpeditimage/editimage.html"]

But the header of the file in question seems to check out:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3/TR
/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title></title>

<script type="text/javascript" src="js/editimage.js?ver=327"></script>
<script type="text/javascript" src="../../utils/form_utils.js?ver=3223"></script>

<link rel="stylesheet" href="css/editimage.css?ver=327" type="text/css" media="all" />

<script type="text/javascript">
if ( 'rtl' == tinyMCEPopup.editor.getParam('directionality','') )
    document.write('<link rel="stylesheet" href="css/editimage-rtl.css?ver=3223"     
type="text/css" media="all" />');
</script>
<base target="_self" />
</head>

UPDATE:

See HTTP header result below.

I just added "AddCharset UTF-8 .html" to a .htaccess file in the directory for now. So my question then becomes: What causes a character encoding declaration to not work?

link|improve this question
Have you checked out the output of HTTP headers? Perhaps Content-Type header sends out other character set or it would also need to say text/html; charset=utf-8 – Janne Pikkarainen Oct 25 '11 at 8:41
curl -I: Content-Type: text/html – Ferdinand.Bardamu Oct 25 '11 at 9:38
"What causes a character encoding declaration to not work?" Charset definition in httpd.conf, check for AddDefaultCharset directive – Lazy Badger Oct 26 '11 at 7:09
It's commented out. Plus the http headers for the file in question don't show a different charset, they don't show one at all. – Ferdinand.Bardamu Oct 26 '11 at 7:46
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.