urlpath_regex questions

["Thomas Raef" <traef@xxxxxxxxxxxxxxxxxx>]

I'm trying to filter some special characters in URLs.

Basically my acl is:
acl badurl url_regex -i \&\#x
http_access allow internal_net !badurl

However, when I hit an URL with <img src="jav&#x9;ascript:alert('test');">
in the access.log it cuts the string off after jav& so the regex never = matches.

Here’s a log entry:

1201648890.642   4063 111.111.111.111 TCP_MISS/200 2774 GET http://www.purevideo.com/video-%22%3E'%3E%3CScR& - DIRECT/64.93.76.15 text/html

This was for this URL: hjjp://www.purevideo.com/video-%22%3E'%3E%3CSc&#x9RiPt%3Ealert(123)%3C/sCrIpT%3E%22'

You see it's cutting off the urlpath right after the '&'.

Does anyone have any ideas as to what I'm doing wrong? Or what I can do to get the entire URL so I can match against my regex?

Thank you in advance.


Thomas J. Raef




No virus found in this outgoing message.
Checked by AVG Free Edition. 
Version: 7.5.516 / Virus Database: 269.19.15/1249 - Release Date: 1/29/2008 9:51 AM