For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mike_Sullivan_2's avatar
Mike_Sullivan_2
Icon for Nimbostratus rankNimbostratus
Sep 16, 2014

Fixing external links (replace escaped ? and =)

Hi All,

I've been asked if our BigIPs can fix an issue with external links. We see them and sometimes the URL contains escaped question marks and equals signs. I am running 11.5.1 HF3 with ASM enabled VIPs and I'm looking for a technique to fix the escaped chars and pass it down to the pool.

In short, how can I convert something like this: 

http://www.mysite.com/dostuff.asp%3fid%3dsomething
into this: 
http://www.mysite.com/dostuff.asp?id=something

There must be a tidy irule or something?

Thanks, Mike

application delivery
ASM Advanced WAF
design
devops
iRules
LTM
security

5 Replies

  • Ryannnnnnnnn's avatar
    Ryannnnnnnnn
    Icon for Altocumulus rankAltocumulus
    Sep 16, 2014

    Hi mate,

    here's one for you:

        when HTTP_REQUEST {

 Disable the stream filter for all requests
STREAM::disable

     remove the compression offerings from the client
HTTP::header remove "Accept-Encoding"
}
when HTTP_RESPONSE {

 Check if response type is text
if {[HTTP::header value Content-Type] contains "text"}{

   Replace
  STREAM::expression {@%3f@?@@%3d@=@}

   Enable the stream filter for this response only
  STREAM::enable

}
}

    You'll need to apply a stream profile to your virtual server too.

  • Mike_Sullivan_2's avatar
    Mike_Sullivan_2
    Icon for Nimbostratus rankNimbostratus
    Sep 16, 2014

    Ryan,

     

    Thanks for your reply. That is very interesting. Would a stream operation be more efficient that a string map operation over the URL?

     

    Also, will this work on inbound gets? I need to intercept bad external links and this looks like it will fix replies.

     

    Thanks, Mike

     

  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    Sep 16, 2014

    GET requests ('Inbound gets') can (and should) be handled without using STREAM, as you have direct access to requests via HTTP::path, HTTP::uri, et cetera.

    Example:

    when HTTP_REQUEST {

    if { [HTTP::path] starts_with "/docs/xyz/" } {

        << do something >>

    }

}

    See the wiki for details.

  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    Sep 16, 2014

    By the way, if you need to decode requests you may want to take a look at URI::decode (see wiki).

     

  • Mike_Sullivan_2's avatar
    Mike_Sullivan_2
    Icon for Nimbostratus rankNimbostratus
    Sep 16, 2014

    Thanks all for helping me get the gears turning. I think I have a solution and I'd like some expert feedback (in case it's just a bad approach).

    Here is the rule I came up with:

    when HTTP_REQUEST { 
set ::theuri [HTTP::uri] 
log local0. "the URI is $::theuri"
switch -glob $::theuri {
     "*%3[fFdD]*" {
    set ::myuri [string map -nocase {"%3f" "?" "%3d" "="} $::theuri]
    HTTP::redirect "http://[HTTP::host]$::myuri"
  }
   }
}

    Let me know what you think.

    Thanks, Mike