# String "fwrite();" causes 503 error (Passenger or apache?)

**URL:** <https://www.ruby-forum.com/t/string-fwrite-causes-503-error-passenger-or-apache/140342>\
**Category:** Rails\
**Created:** [June 13, 2008, 2:31am UTC](https://www.ruby-forum.com/t/string-fwrite-causes-503-error-passenger-or-apache/140342 "2008-06-13T02:31:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/82dd89/32.png) [@ssk](https://www.ruby-forum.com/u/ssk)\
**Post date:** [June 13, 2008, 2:31am UTC](https://www.ruby-forum.com/t/string-fwrite-causes-503-error-passenger-or-apache/140342/1 "2008-06-13T02:31:43Z")

</div>

Hi,

While testing a rails application on DreamHost (mod\_rails), I found a  
really weird problem.

If I submit form data which includes “fwrite();” (with semi-colon but  
without quotes), I get 503 error (Server temporarily unavailable).  
I checked out rails log file and it didn’t even reach the rails app.  
I assume the error was from web server.

You may test this at [http://test.codepremise.com/posts](http://test.codepremise.com/posts) .  
Just add or edit a row and write “fwrite();” in the body field and  
submit.

Any idea?

Sam

---

<div class="post-metadata">

**Author:** ![ssk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/82dd89/32.png) [@ssk](https://www.ruby-forum.com/u/ssk)\
**Post date:** [June 13, 2008, 2:42am UTC](https://www.ruby-forum.com/t/string-fwrite-causes-503-error-passenger-or-apache/140342/2 "2008-06-13T02:42:16Z")

</div>

I just got a reply from Dreamhost tech support.  
It’s related to mod\_security rules.

* * *

It appears that the fwrite in [test.codepremise.com/posts](http://test.codepremise.com/posts) triggered one  
of our mod\_security rules as the following is listed in your error log:

[Thu Jun 12 17:16:48 2008] [error] [client 75.31.73.251] mod\_security:  
Access denied with code 503. Pattern match  
“(chr|fwrite|fopen|system|echr|passthru|popen|proc\_open|shell\_exec|exec|p  
roc\_nice|proc\_terminate|proc\_get\_status|proc\_close|pfsockopen|leak|apache  
\_child\_terminate|posix\_kill|posix\_mkfifo|posix\_setpgid|posix\_setsid|posix  
\_setuid|phpinfo)\\(.\*\\)\\;” at POST\_PAYLOAD [severity  
“EMERGENCY”]  
[hostname “[test.codepremise.com](http://test.codepremise.com)”] [uri “/posts/1”] [unique\_id  
“MZo6DEPNFE8AAFRPBTUAAAAD”]

As a workaround, you can turn off mod\_security for that sub-domain. Just  
go to [Sign in · DreamHost](https://panel.dreamhost.com/index.cgi?tree=domain.manage&) , click  
on the Edit button under “Web Hosting” for [test.codepremise.com](http://test.codepremise.com) and  
uncheck the box for “Extra Web Security?”.