Forum Discussion

JSC's avatar
JSC
Icon for Nimbostratus rankNimbostratus
Jul 04, 2017

ASM XSD validation and `choice` element

Hi,

we have an issue with XSD validation. 

choice
element doesn't work like expected by the W3C specification (https://www.w3schools.com/xml/el_choice.asp😞

Ex:

1. Success

[...]

0

[...]

2. Success !! Why?

[...]

0

0

[...]

We tried many other options (Changing/removing 
minOccurs
, 
maxOccurs
and 
type
attributes), the ASM xml 
choice
element's validation behavior appears to be the same as below:

Ex:

1. Success Choice?

[...]

0

0

[...]

2. Blocked Choice?

[...]

0

0

0

[...]

Can someone confirm the point?

Is it possible to find the version of the XSD schema standard that the ASM validate (BigIP 12.1.2)?

thanks,

JSC

ASM Advanced WAF
security
  • Daniel_Varela's avatar
    Daniel_Varela
    Icon for Employee rankEmployee
    Jul 04, 2017

    what are your blocking settings? Do you see any alarms in your event viewer? Remember to link the xml content profile to the URL/paramenter.

     

  • JSC's avatar
    JSC
    Icon for Nimbostratus rankNimbostratus
    Jul 04, 2017

    Hi Daniel,

    ASM is successfully blocking requests regarding the XSD except for the above 

    choice
    element.

    Alarms are available under "Event logs" however for the choice condition, status is always "Legal Request" while we would expect "XML data does not comply with schema or WSDL document"...

    Note: I add few more samples above

  • Daniel_Varela's avatar
    Daniel_Varela
    Icon for Employee rankEmployee
    Jul 04, 2017

    Maybe the min and max ocurrences are per element? try to set a minoccurs to 1 and verify that in your firt example [...] 0[...] the request is blocked.

     

  • JSC's avatar
    JSC
    Icon for Nimbostratus rankNimbostratus
    Jul 04, 2017

    Well, i tried it with no more success. - Ex 1 (Note: results same if no attribute 

    minOccurs
    is specified) :

    1. Blocked 

      [...]
      [...]

    2. Success 

      [...]
      0
      [...]

    3. Success 

      [...]
      0
      0
      [...]

    4. Blocked 

      [...]
      0
      0
      [...]

    - Ex 2:

    1. Blocked 

      [...]
      [...]

    2. Success 

      [...]
      0
      [...]

    3. Success 

      [...]
      0
      0
      [...]

    4. Success 

      [...]
      0
      0
      0
      [...]

    5. Blocked 

      [...]
      0
      0
      0
      0
      [...]

  • JSC's avatar
    JSC
    Icon for Nimbostratus rankNimbostratus
    Jul 04, 2017

    You are right about minOccurs and maxOccurs:

    *maxOccurs: Optional. Specifies the maximum number of times the choice element can occur in the parent element. The value can be any number >= 0, or if you want to set no limit on the maximum number, use the value "unbounded". Default value is 1

    minOccurs: Optional. Specifies the minimum number of times the choice element can occur in the parent the element. The value can be any number >= 0. Default value is 1*

    However, the choice element doesn't work better if no attributes are specified:

    ==> same result as with attribute 
    minOccurs="1"

  • Daniel_Varela's avatar
    Daniel_Varela
    Icon for Employee rankEmployee
    Jul 05, 2017

    JSC, then is it working as expected? As I understand it, in your last example

     

     

    The ASM must accept a total of one each element and block anything different as min and max are 1.

     

  • JSC's avatar
    JSC
    Icon for Nimbostratus rankNimbostratus
    Jul 05, 2017

    Regarding the w3c standard, we expect below behavior: XML Schema choice element allows only one of the elements contained in the 

    choice
    declaration to be present within the containing element.

    Which is not what we got. SoapUI report the non compliancy, BigIP ASM doesn't...