We have a web app that our client's employees use to submit signatures from customers using HTML5 canvas to create PNG images. The signature pad is converted to base64 encoded HTTP POST data. Our legitimate traffic is flagged as SQL Injection by their router/firewall because it violates the rule defined to prevent SQL injection, specifically due to the XOR operator. We don't want to turn off the firewall rule, especially since it seems to be only the XOR operator, but need to find a way to allow this traffic. Is there any way to modify this rule to accomodate or is the only solution turning it off? Otherwise is there a way to make the rule apply site-wide but turn it off for just the one script it's needed on?
Firewall: Sophos- I'm not sure of the model, firmware, etc. but our customer is still able to get updates which come with new firewall rules switched on by default. This is the 3rd time in a year and a half that the image POST data has been blocked by the firewall.
Web Server: Apache/PHP, not that this should matter much as the web app works fine when not blocked by a firewall.
Actual line of firewall's log:
[msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: XOr found within ARGS:tmp_img: data:image/png;base64,....
