php - 模组安全 : Access denied with code 403

Question

我已经为我的一台服务器启用了 mod 安全性，但是如果我提交一个带有 unicode 字符的表单，它会在日志中显示以下错误并且不允许访问该网页。

[Wed May 192.168.0.1 2013] [error] [client 192.168.0.1] ModSecurity: Access denied with code 403 (phase 2). 
Pattern match "(?i:(?:,.*?[)\\\\da-f\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98][\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98](?:[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98].*?[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]|\\\\Z|[^\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]+))|(?:\\\\Wselect.+\\\\W*?from)|((? ..." at ARGS:shortDescription. [file "/etc/httpd/modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "209"] [id "981257"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data "Matched Data: , \\xe0\\xb6\\xa1\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a\\xe0\\xb6\\xaf \\xe0\\xb6\\xb6\\xe0\\xb6\\xbd\\xe0\\xb6\\xba\\xe0\\xb7\\x99\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a \\xe0\\xb6\\x91\\xe0\\xb6\\xba \\xe0\\xb6\\xb4\\xe0\\xb7\\x99\\xe0\\xb6\\xbb\\xe0\\xb7\\x85\\xe0\\xb7\\x93\\xe0\\xb6\\xb8\\xe0\\xb6\\xa7 \\xe0\\xb6\\x9a\\xe0\\xb6\\xa7\\xe0\\xb6\\xba\\xe0\\xb7\\x94\\xe0\\xb6\\xad\\xe0\\xb7\\x94 \\xe0\\xb6\\x9a\\xe0\\xb6\\xbb\\xe0\\xb6\\xb1 \\xe0\\xb6\\xb6\\xe0\\xb7\\x80\\xe0\\xb6\\xad\\xe0\\xb7\\x8a \\xe0\\xb7\\x80\\xe0\\xb7\\x92\\xe0\\xb6\\xb4\\xe0\\xb6\\x9a\\xe0\\xb7\\x8a\\xe0\\xb [hostname "doomain.test.invalid"] [uri "/admin/add_news_article.php"] [unique_id "UZycDtHvchoAAENNXfYAAABR"] 

Answer 1

如果此站点是生产服务器:run Mod_Security in detection_only mode首先检查日志是否存在误报。

在 CRS 中查找 ID:

localhost:/etc/modsecurity>grep 981257 *.conf
modsecurity_crs_41_sql_injection_attacks.conf:SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "(?i:(?:,.*?[)\da-f\"'`´’‘][\"'`´’‘](?:[\"'`´’‘].*?[\"'`´’‘]|\Z|[^\"'`´’‘]+))|(?:\Wselect.+\W*?from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s*?\(\s*?space\s*?\())" "phase:2,capture,t:none,t:urlDecodeUni,block,msg:'Detects MySQL comment-/space-obfuscated injections and backtick termination',id:'981257',tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2',setvar:'tx.msg=%{rule.id}-%{rule.msg}',setvar:tx.sql_injection_score=+1,setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:'tx.%{tx.msg}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"

看起来你的参数 shortDescription 中有特殊字符。