Public bug reported:
Squidguard is interpreting encoded chars in urls. So if you have
something like "%2F" in your url this becomes "/" in your log file.
Consequently "%0A" becomes a "new line". This is however not the only
dangerous sequence. In example a "%09" becomes a "tab".
This is problematic, since it causes consecuting tools like log-file
analyzers to fail, due to incorrect syntax. For example the sarg package
isn't producing any output, as long as there is even one malformed log
line.
As a workaround the issue can be resolved by removing most of the
content of the HTUnEscape function in HTParse.c (see appended patch).
This stops squidguard entirely from interpreting encoded chars. However
a more desireable solution might be to make a list of "threatening
encoded chars" and filter only those.
Thanks for your efforts
B. Brandt
** Affects: squidguard (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/909016
Title:
log file syntax broken due to interpretation of certain encoded chars
in urls
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/squidguard/+bug/909016/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
