For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

imac_105647's avatar
imac_105647
Icon for Nimbostratus rankNimbostratus
Jun 25, 2010

Encoded ampersand problem

Hello,     I am seeing an issue where an ampersand in the URI is encoded as & semi-colon paramname, so ASM thinks that the parameter name is amp semi-colon paramname and throws a violation on ha...
app sec
BIG-IP Access Policy Manager (APM)
security
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Jun 25, 2010
Hi Ian,

This is probably a result of the web app incorrectly double HTML encoding the URL that the client accessed. The idea fix is to change the app to only HTML encode the URL once. Else, you could use an iRule to do a string map replacement of & amp ; to &: 

when HTTP_REQUEST {

    Check if URI has HTML encoded ampersands
   if {[HTTP::query] contains "amp;"}{

       Set the URI to the path plus query string with & replaced with & in the query string
      HTTP::uri "[HTTP::path]?[string map {& &} [HTTP::query]]

   }
}

Aaron