Bug#305793: Attachment without comment fails due to modsecurity

[Marc Perkins]

I don't know if this should be its own bug or not, but since it's so
similar to #305793 I'll start this here.

After installing modsecurity for Apache (using default settings),
attaching files without a comment results in modsecurity's
SecFilterDefaultAction, with the error message (in the aduit log)
"Error normalizing REQUEST_URI: Invalid URL encoding detected: invalid
characters used".  Uploading attachments with comments does not cause
this error message, and works fine with modsecurity installed.

I've included more details below.

--Marc

Versions:
TWiki: 20040902-3
libapache-mod-security: 1.8.7-1
Apache: 1.3.33-3

Basic modsecurity settings:
    SecFilterEngine On
    SecFilterScanPOST On
    SecFilterCheckURLEncoding On
    SecFilterCheckCookieFormat On
    SecFilterCheckUnicodeEncoding Off


Sample modsecurity error message (from the audit log):

HTTP/1.1 500 Internal Server Error
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
========================================
Request: 24.127.11.7 - - [02/Jun/2005:19:42:26 -0700] "GET
/cgi-bin/twiki/oops/Main/LichenCollection?template=oopssaveerr&param1=Save%20attachment%20error%20/usr/bin/ci%20-q%20-l%20-m%COMMENT|U%%20-t-none%20-w%USERNAME|S%%20%FILENAME|F%%20%3Cbr%20%2F%3Eci:%20missing%20message%20for%20-m%20option%3Cbr%20%2F%3E
HTTP/1.1" 500 542
Handler: cgi-script
----------------------------------------
GET 
/cgi-bin/twiki/oops/Main/LichenCollection?template=oopssaveerr&param1=Save%20attachment%20error%20/usr/bin/ci%20-q%20-l%20-m%COMMENT|U%%20-t-none%20-w%USERNAME|S%%20%FILENAME|F%%20%3Cbr%20%2F%3Eci:%20missing%20message%20for%20-m%20option%3Cbr%20%2F%3E
HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, application/vnd.ms-excel,
application/msword, */*
Accept-Encoding: gzip, deflate
Accept-Language: en-us
Cache-Control: no-cache
Connection: Keep-Alive
Cookie: CGISESSID=207422a0eb936f0be68af3cb58408580
Host: [url]
Referer: http://[url]/cgi-bin/twiki/attach/Main/LichenCollection
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x
4.90; .NET CLR 1.1.4322)
mod_security-message: Access denied with code 500. Error normalizing
REQUEST_URI: Invalid URL encoding detected: invalid characters used
mod_security-action: 500