For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

SSHSSH_97332's avatar
SSHSSH_97332
Icon for Nimbostratus rankNimbostratus
Dec 10, 2013

ASM - Block Extension @ File upload

I want to block any extension from being uploaded to my Website , i want to allow only ".pdf" extension to be uploaded . I cann't used allowed / Disallowed file types as this looks on URI , am i ri...
application delivery
devops
iRules
security
Mike_Maher's avatar
Mike_Maher
Icon for Nimbostratus rankNimbostratus
Dec 10, 2013

Use a regular expression to control the value of the parameter (if the value is the file name). This should work, and it is easy to add more file extensions if you like, below I am allow for .pdf and .doc.

 

(?i).(pdf|doc)$

 

You will probably also have a parameter that is the actual file upload make sure to set that parameter as a file upload value and check the box to say no .exe. I would also recommend using the feature to offload AV scanning of the file to a Scan Engine of some sort.