1

My hosting company have pulled my Drupal website because modsecurity highlighted

Pattern match "(?:\b(?:(?:type\b\W?\b(?:text\b\W?\b(?:j(?:ava)?|ecma|vb)|application\b\W*?\bx-(?:java|vb))script|c(?:opyparentfolder|reatetextrange)|get(?:special|parent)folder|iframe\b.{0,100}?\bsrc)\b|on(?:(?:mo(?:use(?:o(?:ver|ut)|down|move|up)|ve)| ..." at REQUESTFILENAME.

They also said their malware scan highlighted the DB SQL file (cron makes a daily backup)

I've set up the website locally with Apache/Modsecurity/OSWAP download and then used linkchecker and wget whilst tailing the log files and failed to generate the error. I've contaced the Hosting Co and they say they cant give me any more information when i asked for the modSec logs relating to this

I'd like to try and find the problem they say that has stopped the website working and the problem they have identified within the DB.

I've got some basic php and perl experience. Is the regexp pattern as stated above perl - and/or php compatible ? My scripting attempts so far have failed ( which I suspect could be more a reflection on my abilities)

If the regexp is legitimate php or perl , I'll post my attempts so far to find the problem.

Browse other questions tagged or ask your own question.