Page has been moved, because of 'onload' is not allowed in url's

Click here to reach the real page

apache modsec rules

I have just spent several hours, figuring out, why My server gave Error: 303 on the CSS files

Guess what, The apache security rules have been revised, and some more rules were added.

I found out, that one of the rules, did not allow the word 'onload' as part of the url

• Look here for the rules:
http://z.askapache.com/modsec/10_asl_rules.conf
• This is the Rule 340020 :

• # Rule 340020: 
  #XSS in referrer and UA headers 
  SecRule REQUEST_HEADERS:REFERER|REQUEST_URI "! 
  (?:/plugins/editors/tinymce/jscripts/|/modules/tinymce/tinymce/jscripts|/phpi 
  nfo_iframe\.php)" \ 
         "id:340020,t:replaceNulls,t:htmlEntityDecode,t:urlDecodeUni,t:compres 
  sWhiteSpace,t:lowercase,rev:11,severity:2,msg:'XSS in referrer and UA 
  headers',chain"   
  SecRule REQUEST_HEADERS:REFERER "!(^pagead[0-9] 
  \.googlesyndication\.com/pagead/|/gills\.swf?txt=<a href= ? 
  asfunction:_root\.launchURL|vbscript.*convert.*&hl=.*client=|convert.*vbscrip 
  t.*Search)" chain 
  SecRule REQUEST_HEADERS:REFERER|REQUEST_HEADERS:User-Agent "(?:<[[:space:]]* 
  (?:script|about|applet|activex|chrome).* 
  (?:script|about|applet|activex|chrome)[[:space:]]*>|activexobject| 
  (?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec) 
  script|\.fromcharcode|get(?:parentfolder|specialfolder)|iframe 
  |\.innerhtml|\
  

• This is the error found in the log files :

• [Sun Sep 28 08:31:40 2008] [error] [client ***********] ModSecurity: 
  Access denied with code 403 (phase 2). Pattern match "(?:<[[:space:]]* 
  (?:script|about|applet|activex|chrome).* 
  (?:script|about|applet|activex|chrome)[[:space:]]*>|activexobject| 
  (?:\.add|\@)import|asfunction\:|background-image\:|e(?:cma|xec) 
  script|\.fromcharcode|get(?:parentfolder|specialfolder)|iframe |\.i ..." 
  at REQUEST_HEADERS:Referer. 
  [file "/etc/httpd/modsecurity/10_asl_rules.conf"] [line "146"] [id "340020"] 
  [rev "14"] [msg "XSS in referrer and UA headers"] [severity "CRITICAL"] 
  [hostname "www.finnrasmussen.dk"] [uri "/demo/anker-body-onload/"] 
  [unique_id "50hySsHJI2AAAHiTq1QAAAAB"]
  

	ViewList (100)