A long time ago, I raised an item in the old forum about an issue I was experiencing with Event Confirmation emails sent to the Email Activity Processor being rejected with this message:
Failed Processing: Registration Confirmation - [event name]. Reason: Illegal characters in input (potential scripting attack)
See my original posting here: https://forum.civicrm.org/index.php?topic=29606.0
I have finally diagnosed and fixed this problem.
The common SocialNetworks.tpl template is used to load a block of HTML to add social network buttons. This is used on web pages and in email confirmations. It contains a call to include a Google APIs script and it is this that is causing the IDS attack alert.
My simple resolution is to move this script inclusion from line 27 to line 45 so that it is inside an IF clause that only applies to web pages.
Sorry - this isn't really a question, so let me make it one. Do you agree with my diagnosis and should I apply a patch?