I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so:

<div><span+style="color:#333333">TEST Test,</span></div>   

How can I pass these tags without triggering ModSecurity and the request getting blocked?

  • 3
    What ModSecurity rules are you using? Are you using the OWASP ModSecurity CRS? Have you tried something yourself? Have you identified the rule that blocks the request?
    – Sjoerd
    Commented Sep 19, 2018 at 11:11
  • @Sjoerd I'm using OWASP ModSecurity CRS and it blocks the request.
    – mrashid
    Commented Sep 19, 2018 at 13:13
  • 2
    This is yet another reason why ensuring your inputs are escaped is a much better defense against XSS than trying to reject things that look like HTML. Commented Sep 19, 2018 at 13:36

1 Answer 1


When normal behavior of the application is blocked by the rule set, this is called a false positive. The article Handling False Positives with the OWASP ModSecurity Core Rule Set may be of help to you. It describes how to identify the rule that blocks valid requests and to disable it using the SecRuleRemoveById configuraiton directive.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .