ModSecurity blocked access due to the following:

[msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched Data: esrco found within ARGS:as_email:hearsesesrcool@yahoo.com"] [severity "CRITICAL"]

Why does the string esrco trigger an error? I tried googling any javascript implications and could not find any. Should I disable this rule?

  • Are you sure it's the string "esrco" itself which is triggering this?
    – forest
    Jun 15 '18 at 3:12
  • I copied and pasted the exact error message that I was getting in the log.
    – Mocking
    Jun 15 '18 at 19:27
  • Potentially helpful: stackoverflow.com/a/34027786/1060378
    – schroeder
    Jul 19 '18 at 7:27

It is the 'src' in esrco that triggers the rule.

I had to deactivate that rule, because it was impossible to forbid the string src across the whole application.

  • 1
    I had to look for a while to find out that you were correct (because the message seemed to contradict you). Next time, please include some source our backup to any claims. I have added the source to your answer.
    – schroeder
    Jul 19 '18 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.