问题
I have enabled mod security for one of my servers how ever if I submit a form with unicode characters it shows the following error in the log and doesn't allow to access the web page.
[Wed May 192.168.0.1 2013] [error] [client 192.168.0.1] ModSecurity: Access denied with code 403 (phase 2).
Pattern match "(?i:(?:,.*?[)\\\\da-f\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98][\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98](?:[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98].*?[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]|\\\\Z|[^\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]+))|(?:\\\\Wselect.+\\\\W*?from)|((? ..." at ARGS:shortDescription. [file "/etc/httpd/modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "209"] [id "981257"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data "Matched Data: , \\xe0\\xb6\\xa1\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a\\xe0\\xb6\\xaf \\xe0\\xb6\\xb6\\xe0\\xb6\\xbd\\xe0\\xb6\\xba\\xe0\\xb7\\x99\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a \\xe0\\xb6\\x91\\xe0\\xb6\\xba \\xe0\\xb6\\xb4\\xe0\\xb7\\x99\\xe0\\xb6\\xbb\\xe0\\xb7\\x85\\xe0\\xb7\\x93\\xe0\\xb6\\xb8\\xe0\\xb6\\xa7 \\xe0\\xb6\\x9a\\xe0\\xb6\\xa7\\xe0\\xb6\\xba\\xe0\\xb7\\x94\\xe0\\xb6\\xad\\xe0\\xb7\\x94 \\xe0\\xb6\\x9a\\xe0\\xb6\\xbb\\xe0\\xb6\\xb1 \\xe0\\xb6\\xb6\\xe0\\xb7\\x80\\xe0\\xb6\\xad\\xe0\\xb7\\x8a \\xe0\\xb7\\x80\\xe0\\xb7\\x92\\xe0\\xb6\\xb4\\xe0\\xb6\\x9a\\xe0\\xb7\\x8a\\xe0\\xb [hostname "doomain.test.invalid"] [uri "/admin/add_news_article.php"] [unique_id "UZycDtHvchoAAENNXfYAAABR"]
回答1:
If this site is a producive server: run Mod_Security in detection_only mode first and check the logs for false positives.
Look in the CRS for the ID:
localhost:/etc/modsecurity>grep 981257 *.conf
modsecurity_crs_41_sql_injection_attacks.conf:SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "(?i:(?:,.*?[)\da-f\"'`´’‘][\"'`´’‘](?:[\"'`´’‘].*?[\"'`´’‘]|\Z|[^\"'`´’‘]+))|(?:\Wselect.+\W*?from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s*?\(\s*?space\s*?\())" "phase:2,capture,t:none,t:urlDecodeUni,block,msg:'Detects MySQL comment-/space-obfuscated injections and backtick termination',id:'981257',tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2',setvar:'tx.msg=%{rule.id}-%{rule.msg}',setvar:tx.sql_injection_score=+1,setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:'tx.%{tx.msg}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"
Looks like you have special characters in your argument shortDescription.
回答2:
Another hint: If you have a rule which provokes a lot of "false positives", you easily can disable it (even specifically for a given path) using the SecRuleRemoveById keyword. Example for the error in your question:
<Directory /var/www/admin>
SecRuleRemoveById 981257
</Directory>
Assumed /var/www is the DOCUMENT_ROOT used. This way you can use the complete provided ruleset, but disable single rules where they should not be applied.
来源：https://stackoverflow.com/questions/16708385/modsecurity-access-denied-with-code-403