Forum Discussion

tminfw2's avatar
tminfw2
Icon for Nimbostratus rankNimbostratus
Jan 29, 2015

Bare byte decoding and French characters

Currently, our ASM policies are configured with bare byte decoding check activated. However, this poses problems, as some of our legitimate French pages are flagged with this error. Specifically, it ...
ASM Advanced WAF
management
security
Stefan_Klotz's avatar
Stefan_Klotz
Icon for Cumulonimbus rankCumulonimbus
Oct 30, 2015

Hi Nathan,

I don't think I get your point. What do you mean with "I think by uri is your best bet"? Do you mean I have to disable ASM for the affected URI at all (I don't know at the moment if it affects only one or a few URIs).

I also made some further testing and it seems to be also depending on the used browser. The violation is caused by this parameter:

DBParamValue=Libell%E9%20fonds%20ou%20code%20ISIN

When using IE it doesn't matter if I use Libellé, Libell%E9 or Libell%C3%A9 (this is the correct UTF-8 encoding) the violation triggers all the time. But interesting is that the encoding settings in IE is correctly set to UTF-8.

Whereas when using FF it triggers only when using %E9, the other two options will be encoded "correctly".

Ciao Stefan 🙂