For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

imac_105647's avatar
imac_105647
Icon for Nimbostratus rankNimbostratus
Jun 25, 2010

Encoded ampersand problem

Hello,

 

 

I am seeing an issue where an ampersand in the URI is encoded as & semi-colon paramname, so ASM thinks that the parameter name is amp semi-colon paramname and throws a violation on having the semi-colon in there.(You need to replace space semi-colon space with just a semi-colon to see what I mean as the forum won't allow me to write exactly the string I see.)

 

 

Is there are switch I can throw that will get the ASM to decode the & semi-colon to just &?

 

 

Thanks, Ian

 

app sec
BIG-IP Access Policy Manager (APM)
security

1 Reply

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jun 25, 2010
    Hi Ian,

    This is probably a result of the web app incorrectly double HTML encoding the URL that the client accessed. The idea fix is to change the app to only HTML encode the URL once. Else, you could use an iRule to do a string map replacement of & amp ; to &: 

    when HTTP_REQUEST {

    Check if URI has HTML encoded ampersands
   if {[HTTP::query] contains "amp;"}{

       Set the URI to the path plus query string with & replaced with & in the query string
      HTTP::uri "[HTTP::path]?[string map {& &} [HTTP::query]]

   }
}

    Aaron