Can I allow Buffer Overflow attack signatures in just an XML request?

Hi Scott,

I used this irule to unblock ASM for an URL:

when ASM_REQUEST_DONE {

if {[ASM::violation names] contains "ATTACK_TYPE_BUFFER_OVERFLOW" and (([string tolower [HTTP::uri]] contains "/yourURL"))} {

ASM::unblock

log local0. "ASM unblocking [HTTP::uri]" }

}

look this documentation:

ASM::unblock - https://devcentral.f5.com/wiki/irules.asm__unblock.ashx ASM::violation - https://devcentral.f5.com/wiki/irules.asm__violation.ashx ASM Violation names/tables - https://devcentral.f5.com/wiki/irules.asm__violation_data.ashx ASM_REQUEST_DONE - https://devcentral.f5.com/wiki/iRules.ASM_REQUEST_DONE.ashx HTTP::uri - https://devcentral.f5.com/wiki/iRules.HTTP__uri.ashx