Alternative solution. From: Damien Tournoud --- bootstrap.inc | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git includes/bootstrap.inc includes/bootstrap.inc index d979820..735281f 100644 --- includes/bootstrap.inc +++ includes/bootstrap.inc @@ -499,6 +499,12 @@ function drupal_environment_initialize() { $_SERVER['HTTP_HOST'] = ''; } + // Block processing if there is invalid UTF-8 input in the request. + if (!drupal_valid_utf8(serialize($_GET)) || !drupal_valid_utf8(serialize($_POST)) || !drupal_valid_utf8(serialize($_COOKIE)) || !drupal_valid_utf8(serialize($_FILES))) { + header($_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request'); + exit; + } + // When clean URLs are enabled, emulate ?q=foo/bar using REQUEST_URI. It is // not possible to append the query string using mod_rewrite without the B // flag (this was added in Apache 2.2.8), because mod_rewrite unescapes the