rewrite a character with HTTP POST data

Here is some info on URL (or percent) encoding:

http://en.wikipedia.org/wiki/Percent-encoding

Percent-encoding reserved characters

When a character from the reserved set (a "reserved character") has special meaning (a "reserved purpose") in a certain context, and a URI scheme says that it is necessary to use that character for some other purpose, then the character must be percent-encoded. Percent-encoding a reserved character involves converting the character to its corresponding value in ASCII and then representing that value as a pair of hexadecimal digits. The digits, preceded by a percent sign ("%"), are then used in the URI in place of the reserved character.

The reserved character "/", for example, if used in the "path" component of a URI, has the special meaning of being a delimiter between path segments. If, according to a given URI scheme, "/" needs to be in a path segment, then the three characters "%2F" or "%2f" must be used in the segment instead of a raw "/".

This blog entry (Click here) suggests you may need to XML encode the element value and then URL encode it. So the XML encoded equivalent for & is & amp ; (without the spaces). & amp ; (without the spaces) URL encoded would be %26amp;.

If you're able to test this, try the following rule which replaces & with %26amp;

    
      when HTTP_REQUEST {        
            
          Disable the stream filter by default        
         STREAM::disable        
            
          Check if the request is a POST, with a content type of text, from the Jakarta user agent      
         if {[HTTP::header value Content-Type] contains "text" \      
            && [HTTP::header value "User-Agent"] contains "Jakarta-HttpComponents"}{      
        
             Match the literal string "&" and replace it with %26amp;    
            STREAM::expression {@&@%26amp;@}    
        
             Enable the stream filter for this request only        
            STREAM::enable        
         }        
      }         
      when STREAM_MATCHED {      
          This event is only included for debugging.  You should remove the event after testing is complete.      
         log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match]"        
      }    
    

If that doesn't work, try replacing the STREAM::expression line with this:

STREAM::expression {@&@%26@}

Aaron