A question about mod_security error

[lcs01]

One of my complany's page has a form input. If a user enter some invalid string, there will be an error on the server side:

mod_security: Invalid Unicode encoding: invalid byte value

I tend to believe it is a configuration issue. But I don't know how to configure it. I don't even know where to start. Could someone lend me a hand?

Many thanks!

 

[lcs01]

I found an answer on the web:

http://blog.gmane.org/gmane.comp.apache.mod-security.user/month=20040501

quot.
====
psyonic_blast <at> inbox.lv wrote:
> Hello mod-security-users,
>
> tell me please, how can i correct this error ?
> [error] [client 213.182.221.133] mod_security: Invalid Unicode encoding: invalid byte value

Add

SecFilterCheckUnicodeEncoding Off

to your web server configuration.
======
unquot

 

[lcs01]

It works by adding "SecFilterCheckUnicodeEncoding Off".

Thank you all for reading this.

 

[KevinADC]

Yes but mod_security is checking for HTTP vulnerablites. I'd search arround and read up on mod_security before applying fixes that you may not understand the implications of. If you do understand what you are doing then never mind.

- Kevin, perl coder unexceptional!

 

[lcs01]

Actually, I don't quite understand this issue. I would prefer to post a warning telling a user his/her input was invalid. However, it seems to me that web server does not know how to handle it, so that it simply post a 403 error.

Is there a way to configure the web server, so it can actually catch all the invalid error and post an informative warning?

Thanks.

 

[KevinADC]

Personally I don't know enough about it to make a suggestion. But you can start on this page and read up on mod_security and see if there is a way to do waht you want:

http://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/html-multipage/

- Kevin, perl coder unexceptional!

 

[lcs01]

Thank you, Kevin.

The site you recommended is quite helpful. There is an Appendix at the site called "Recommended Configuration". I copied a few lines here for someone who could be interested:

================

http://www.modsecurity.org/document...l-multipage/aa-recommended_configuration.html

Appendix A: Recommended Configuration

# Some sane defaults
SecFilterScanPOST On
SecFilterCheckURLEncoding On
SecFilterCheckUnicodeEncoding Off