Forum Discussion

StewartT_232774's avatar
StewartT_232774
Icon for Nimbostratus rankNimbostratus
Apr 12, 2019

Email Addresses as part of URL?

I have a customer that is using email addresses as part of a URL path. This causes a few issues with file types, requiring me to allow things like .com (which I would prefer to block as executable).

 

What is the best way to approach this issue?

 

ASM Advanced WAF
security
  • Yoann_Le_Corvi1's avatar
    Yoann_Le_Corvi1
    Icon for Cumulonimbus rankCumulonimbus
    Apr 12, 2019

    Hi

     

    What I have used in the past for that is the ASM::unblock

     

    With a more precise regex, match the URL with email addresses (send us an example if you want I'll try to help with the regex 🙂 ), and for thos URL, if a violation of type ILLEGAL FILE TYPE is triggered then unblock it.

     

    An exemple in my code :

     

    if { $uri starts_with "/app/rpc"} {
    if { $asmviolation equals "VIOLATION_ATTACK_SIGNATURE_DETECTED"  || $asmviolation equals "VIOLATION_METACHAR_IN_DEF_PARAM"} {
        log local0. "DEBUG!! ASM EXCEPTION - ALLOW $uri - VIOLATION : $asmviolation"
        ASM::unblock
        }
}

    You can also group your exceptions regex in a datagroup.

     

    Hope this helps.