Encode POST data before sending to server...

[ghost]

Prerequisites

• I have searched for similar features requests in both open and closed tickets and cannot find a duplicate.
• The feature is still missing in the latest stable version of Elementor ( Elementor Pro )

What problem is your feature request going to solve? Please describe.

I’m seeing 403 errors when I try to save some pages; especially if there is any custom CSS or HTML elements. This is a result of mod_security2 on Apache2 interpreting some of the POST data as Remote Command Execution, Cross-Site Scripting, or other possible exploit attempts. The portions of the POST data that causes the triggers do look concerning out-of-context, even though they are not malicious.

Describe the solution you'd like

It would be nice if... Elementor POST data was encoded on the client-side before submitting it to the server, then decoded on the server side before validation/sanitation and use/storage. Just about any encoding method would prevent mod_security2 from interpreting the POST data as anything other than random characters. Whatever encoding provides the best performance, as long as it hides $, <, >, , = and other characters that might be interpreted as shell or script commands. Base64 encoding would probably do the job.

Describe alternatives you've considered

I have attempted to disable mod_security2 "rules" that get triggered by Elementor POST data in the web site .conf file. For example,

<LocationMatch "^/wp-admin/admin-ajax.php">
   SecRuleRemoveById 941110
   SecRuleRemoveById 941160
   SecRuleRemoveById 941370
   SecRuleRemoveById 949110
   SecRuleRemoveById 980130
</LocationMatch>

However, it seems like as soon as I disable a rule, another one starts getting triggered, leading to a lot of rules getting disabled. Also, doing something like this disables those rules for all requests at the specified location, leaving the server open to real threats.

In addition, something like the following two examples may treat the symptoms, but leave the server open to attack...

<LocationMatch "^/wp-admin/admin-ajax.php">
   SecRuleRemoveById 930000-944999
</LocationMatch>

<LocationMatch "^/wp-admin/admin-ajax.php">
   SecRuleUpdateTargetById 930000-944999 "!ARGS:elementor_ajax"
</LocationMatch>

Additional context

It is difficult to give real world data here without revealing sensitive customer data. But I think you get the idea from the preceding information.

[ghost]

This should help in your development...
Base64 encoding unicode string with javascript