For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

SSHSSH_97332's avatar
SSHSSH_97332
Icon for Nimbostratus rankNimbostratus
Dec 10, 2013

ASM - Block Extension @ File upload

I want to block any extension from being uploaded to my Website , i want to allow only ".pdf" extension to be uploaded . I cann't used allowed / Disallowed file types as this looks on URI , am i ri...
application delivery
devops
iRules
security
Torti_93733's avatar
Torti_93733
Icon for Nimbostratus rankNimbostratus
Dec 13, 2013

To check for an extension is no save way to allow only pdf files. You have to look into the file or a pdf-file can be something else.

 

Mike_Maher's avatar
Mike_Maher
Icon for Nimbostratus rankNimbostratus
Dec 16, 2013
Agreed. This is just checking that someone doesn't accidentally submit something else, you want to use the AV integration to check for malicious files. I am not sure if the the no .exe's check box actually looks at the file or just the extension. Torti - From a Big-IP standpoint do you have any suggestions on how to check into the file to determine what it really is? I don't know of any way to do that on the Big-IP but would be interested in any thoughts on the subject.