Forum Moderators: coopster

Message Too Old, No Replies

Dynamic url causes 406 Not Acceptable by Apache

Appears to be caused by (newly) offensive characters passed

         

Epilagus

3:53 am on Apr 20, 2008 (gmt 0)

10+ Year Member



After constructing a url of the form
somescript.php?a=param1&b=param2&text=somevariabletext

in javascript, from time to time certain text characters will cause the Apache server running Php 5.0 to return the http 1.1 status of 406 Not Acceptable. After much effort it was found to be caused by several characters in the text, noteably #, %, and chr(128). This behavior was only partly suppressed by escaping the text as in escape(text). It seems as thought our hosting company has placed some security filters with the change from php4.3 to php5.0.
Although encodeURIComponent(text) will behave pretty well we had to resort to some ad hoc gimmickry to make it behave with any input text a user might present and not cause the 406 problem. On the server side, we found that $_GET array, and indeed the php script was never even receiving the variables due to the Apache 406 treatment.
The test case is with % (%25). I am not happy with our solution because we must actually replace % with another character in the javascript, URI encode it, send it over, utf8_decode() it, and then change it back to % in the php script. Not elegant at all.
If you additional info about this, I would like to know whats going on.

penders

11:33 am on Apr 20, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I have experienced similar when mod_security has been enabled on the server. In order to try and prevent certain XSS attacks. Certain parameter names (eg. site=) would cause this and occasionally if the value was a URL that included the full protocol (eg. [)...] - but I think the later case depended also on the parameter name. In short, I just had to avoid using the character sequences that caused the 406 error!?

Epilagus

5:30 pm on Apr 20, 2008 (gmt 0)

10+ Year Member



Indeed, my earlier work around was to strip # from the parameter list (which had been ok). However, the text is user generated and must be preserved. I've likewise noticed certain parameter names are now discarded, notably debug=. I haven't tested forms or ajax, but I would guess that they are going to be broken by the mod_security as well.