1

I have some text areas in a form that are posted back and stored using PHP / MySQL. However, if a user presses return for a new line in the text area, mod_security is blocking it with the below log entry:

Pattern match "\\W{4,}" at ARGS:notes. [file "/etc/httpd/modsecurity-crs/base_rules/modsecurity_crs_40_generic_attacks.conf"] [line "37"] [id "960024"] [rev "2"] [msg "Meta-Character Anomaly Detection Alert - Repetative Non-Word Characters"] [data "Matched Data: \x0d\x0a\x0d\x0a found within ARGS:notes: This is Test Request #5\x0d\x0a\x0d\x0aThanks"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"]

My question is this....is there anything more I can do in my code or a small exception I can make in mod_security? I don't want to disable this entire rule because it's important but, at the same time, I need users to be able to enter data in text areas with returns if they'd like.

Thank you.

Improve this question

2 Answers 2

Reset to default
1

Easiest way is to disable the Rule for the URL receiving the POST:

<LocationMatch /URL/path/to/application>
     SecRuleRemoveById 960024
</LocationMatch>
Improve this answer
1

Well late, but....

You should have a set of custom rules that either preceed or follow the rulesets, generally if you're removing rules or routes, you do it in a file that has a low CRS number. Modifications to the rulesets take place after the CRS files.

We use 10 and 65 respectively.

What you should be attempting to do is create an exclusion for the specific ARG rather than turning the rule entirely off, as that removes protection.

eg SecRuleUpdateTargetById 960024 !ARGS:notes

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#SecRuleUpdateTargetById

Gotcha: A single field doesn't need double-quotes, but multiple fields do - "!ARGS:notes, !ARGS:q"

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .