Plugin Author
AITpro
(@aitpro)
Yep, %27 is the URL encoded single quote code character which is explicitly blocked in the BPS root htaccess Query Strings Exploit code. To whitelist/allow %27 in Query Strings see this forum topic: http://forum.ait-pro.com/forums/topic/apostrophe-single-quote-code-character/#post-6939
That took care of all but the links with a (words) in them. How to fix the ( filter and my risk by fixing it like the others.
Plugin Author
AITpro
(@aitpro)
Yep, you will also need to whitelist/allow round brackets/parentheses ( and ).
See this forum topic: http://forum.ait-pro.com/forums/topic/allowing-parentheses-in-query-strings/#post-10589
Important Note: You will need to combine both your single quote code character/apostrophe and round bracket code character/parentheses code together so that both are whitelisted/allowed.
Plugin Author
AITpro
(@aitpro)
The security line of code which is being modified is not stated in that forum link above, which I will update in a minute.
The security line of code for round brackets is this one.
Before:
RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>|%3c|%3e).* [NC,OR]
After:
RewriteCond %{QUERY_STRING} ^.*(<|>|%3c|%3e).* [NC,OR]
Looking at the filters one at a time, I am starting to understand what they filter but not the reason. Except assume a lot of them are XSS and SQL injection filters.
Thanks for your help with these issues. This will help clean up some more junk on my webmaster tools.
Forgot to close the thread.
Plugin Author
AITpro
(@aitpro)
By default WordPress already filters out html characters that are considered dangerous and can be exploited: “, ‘, <, >, (, ) etc…. Example: when you create a Post your URL will not contain any of these characters. WordPress also filter strings and will automatically URL encode strings that should be encoded. So BPS adds an extra layer of insurance and in some cases there are methods to inject or poison things so these BPS filters are actually useful.
The reason is simple: everything that has the possibility of being exploited should be sanitized or not allowed and known attack vector patterns should not be allowed.
