Forum Discussion

omontee_369264's avatar
omontee_369264
Icon for Nimbostratus rankNimbostratus
Aug 16, 2018

Hyperlink blocking

Dear all,

 

Could you tell me how we could block HTTP POST request containing hyperlink (in application/x-www-form-urlencoded) ?

 

Best regards,

 

Olivier MONTEE

 

  • Hi,

    You can try something like that (I don't tested It, maybe you will finetune it):

    when HTTP_REQUEST {
    
    set collect 0
    
    if { [HTTP::method] eq "POST" } {
          if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] <= 1048576 } {
             set content_length [HTTP::header value Content-Length]
          } else {
             set content_length 1048576
          }
          if { $content_length > 0 } {
             HTTP::collect $content_length
             set collect 1
          }
       }
    }
    when HTTP_REQUEST_DATA {
    
    if {$collect} {
        set payload [HTTP::payload]
        log local0. $payload
    
        if {$payload contains "http://" || $payload contains "https://"} {
            reject
        }
    }  
    }
    

    And of course you can optimise this irule by setting your condition more precisely according to your needs.

    Regards