|
This blog has moved! Please update your bookmarks to http://www.blog.modsecurity.org. |
« Selective Filtering | Main | New action: pause »
Posted by ivanr on July 23, 2003.
I've just committed the Unicode validation feature to the CVS. It is a very good thing to have if the application or the operating system support and/or understand Unicode. Most importantly, this feature will protect from attacks where an ASCII character is encoded with more than one byte thus avoiding detection. In addition to this, ModSecurity checks that there is sufficient number of bytes available, and that all bits in all bytes have correct values. For a detailed description of the Unicode attack have a look at the OWASP guide.
Posted by ivanr at July 23, 2003 09:15 PM