Forum Discussion
APM URL encoding Hardening?
Some companies still use on-prem Sharepoint.. and Sharepoint is what it is.
We have had multiple servers deployed for quite some while now with ASM tuned for its quirks and so on.
However - after upgrading to version 17.5.1.6 from 17.5.1.5 we noticed some rather strange behaviors.
Like the edit modal button stopped working on certain sites, the upload button stopped working amongst some of the stuff. After some testing and stripping of functions we noticed that it started working when removing the APM policy. So the cogs started turning, what could be the issue with APM?
Finally figured out that the links which did not work where not encoded, and the links which worked were.
So after some tweaking I got to building a simple http request rewrite iRule for simply encoding the stuff before sending to server.
But I do have some qualms about it - Are there any security risks according to you dear people that I might introduce by deploying this externally? Would you have solved it in any other way?
basically it's this:
when HTTP_REQUEST {
# Re-encode characters that are illegal in URIs per RFC 3986 §2.2 / §3.4set orig_uri [HTTP::uri]
set new_uri [string map {
"\{" "%7B"
"\}" "%7D"
"|" "%7C"
"\\" "%5C"
"^" "%5E"
"`" "%60"
" " "%20"
} $orig_uri]
if { $new_uri ne $orig_uri } {
HTTP::uri $new_uri}
}
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com