WebShield incorrectly blocking page

The current version of Avast webshield doesn’t seem to like the following URL:
http://library.ilcso.illinois.edu/uiu/cgi-bin/Pwebrecon.cgi?DB=local&PAGE=pbLogon

I’ll post what happens if you are unable to reproduce the error. Basically, only part of the web page loads. It took awhile to troubleshoot this problem… sniffer showed the full HTTP stream was coming in, but none of 3 browers would show the page. There is a 94a on top of the source, above the !DOCTYPE.

Thanks for looking into this!

opens perfectly for me… ??? Don’t think it’s a Web Shield problem as it’s not blocking URL’s. If you hasn’t manually configured it to block the specific pages. (URL Blocking card in Resident > Web Shield > Customize)

Thanks for checking YLAP. The problem occurs on all browsers for me (Firefox, Opera, IE) unless I disable Avast Webshield. I can also make it work by enabling Webshield and inserting the URL into the exclude section. I’ll post the incorrect HTML shortly.

I’ve just checked on another machine with Avast webshield and I have the same problem except on top of the page it says 924 instead of 94a.

Here is the HTML which I see when I go to view source in a browser while webshield is running. Ethereal confirms the correct HTTP response is being sent to the machine.

The part which says:

HREF="/uiu/cgi-bin/Pwebrecon.cgi?PAGE=REQNOBIB&SE
7e
Q=20050802125048&PID=7845

is incorrect as there is no 7e in the HTML.
Both machines I have tested on are WinXP SP2 with all current hotfixes applied.

94a

UIUC's ILLINET Online Patron Logon Start a New SearchSearch All ILCSO LibrariesSearch Other LibrariesOpen My AccountLoginRequest Title

Thanks keystroke,
it was really a bug in webshield’s code.

Can you please try to download this patch (into avast folder) and try it. You’ll have to restart WebShield (terminate and start again) in order to load the patched module (ashwsftr.dll).

http://www2.asw.cz/~rypacek/ws_patch.zip

Edit: unpack both files into c:\program files\alwil software\avast4\ folder.

Lukor, is there any need to do the same for me? ???

I don’t know your configuration, perhaps there are reasons why the problem is not visible at your place. It is definitely a bug, or let’s say minor omission in the code. 99,9% percent of pages should not be affected by that - this one is the 0,1%.

The patch will of course be included in the next update, but we do not expect it sooner than in September.

Thanks for info. As it’s not a problem for me, I’ll wait for BETA. Maybe it’ll be sooner than in August! :wink:

My mistake. I’ve found what is missing in that page… :-\ Donloaded patch too. Thanks to ALWIL team everything now works fine in that page. ;D

For me that page didn’t load fully, I downloaded the patch terminated web shield, copied both files into the avast4 folder, restarted web shield and the page then appears to have loaded fully.

The patch works, I can see the page completely now. Thanks Lukor for the link and keystroke for finding the bug. :slight_smile:

Same problem fix works…Gracias

Thanks lukor for the patch, and everyone else for testing it before I had a chance. It works great! I’m glad to help Avast by finding this little bug. Out of curiosity, could you spare some more technical details as to just what was going on in that webpage which caused Avast to block it? What is the significance of the numbers on the top?

Thanks!

In the headers of the page there was one:

“Client-Transfer-Encoding: chunked”

This confused avast! in some place in the code. Avast! searches for the header “Transfer-Encoding: chunked”. This header is checked during the transfer to detect if chunked encoding is used or not. One of the checks had a bug and incorrectly switched the stream to chunked encoding where it should not. The numbers you can see are headers of this encoding - number of bytes that follows.

Oh is that all it was … :o ???

yes.

I am having the same problem of some pages not loading eg. http://us.cnn.com/
I tried this patch and it partially worked as it now displays the page BUT if I click on any of the links, they don’t load and if I hit the “back” button on IE the original page does not load.

P.S. It seems to only be an I.E. issue as it works fine in Firefox

Please help,

Aciss

Well my primary browser is firefox, but I tried it with IE and Avant (an IE based browser), the links work as does the back button.

So I guess its back to the drawing board.
Have you tried it with the web shield terminated, does it work?
If so, what is your firewall as this could have an effect?

It does work with Web Shield is turned off and I noticed it does work when IE is set to block all cookies. Those are the only instances where it works.

P.S. I turned off my firewall - Sygate and it still did not work!

Then it looks like the site requires cookies to be allowed (which is strange), but why it would make a difference I don’t know. The cookies for cnn.com are what are called session cookies and are only valid for that day.

Generally I don’t block cookies I only block third party cookies, e.g. those not of same origin as the web site you are in. I did notice that some content comes from cnn.net but it doesn’t appear to try to set a cookie for cnn.net which would be classed as a third party cookie.

Perhaps you need to change the Topic/Thread Title as it is now obvious it is not web shield blocking the web site?

I don’t think cookies is the issue as when I turn off webshield it works and if I use firefox it works. I think it is a webshield issue