Forum Discussion

Piotr_Lewandows's avatar
Piotr_Lewandows
Icon for Altostratus rankAltostratus
Jun 29, 2018

ASM same URL variants

Hi,

 

I wonder why (13.1.0.7, Comprehensive, Automatic Learning, Always for URLs) for some URLs two entries (Explicit) are created, for example:

 

  • /
  • /.

I never saw request containing URL /. so why those are added by policy building process?

 

Above examples are not alone, there are other URLs added like that but not all - can't see logic here.

 

After policy is stabilized all URLs with . at the end remains in staging and counterparts without . are no longer in staging.

 

Piotr

 

allowed url
ASM Advanced WAF
automatic
comprehensive
polcy building
security
staging
  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Jun 29, 2018

    I've not see that before, but isn't dot (.) used as a wildcard in regex, as well as asterix (*)?

     

  • dragonflymr's avatar
    dragonflymr
    Icon for Cirrostratus rankCirrostratus
    Jun 29, 2018

    Hi,

     

    Well, I thought so but those URLs are defined as Explicit so there is no point to use any regex related characters - or I am wrong?

     

    I was suspecting iMacro script used to build policy but then I tried to issue request like /. or /folder/. - those are converted to / or /folder/ so it's even not possible to send trailing . to ASM.

     

    I did policy building using the same iMacro few times and each time after policy is stabilized (wildcards removed) I am left with few of those URLs with trailing dot in staging.

     

    Those seem to be not used for any purpose but somehow were created by policy builder.

     

    Piotr

     

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Aug 10, 2018

    This looks odd, might be a bug in this version of ASM - I recommend raising a support case with F5