For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Philipp_Stadler's avatar
Philipp_Stadler
Icon for Nimbostratus rankNimbostratus
Feb 17, 2014

input validation

Hi all,

I'm wondering that there are no useful search results for input validation of user-input in irules. I want to do a simple task:

when HTTP_REQUEST {
    set cookie [HTTP::cookie id]
}

I do some additional tasks (log, fill tables, ...) with $cookie, but prior to this I want to proper validate the input from HTTP::cookie and I'm not sure how to do that in a right way.

Thanks for your suggestions, Philipp

application delivery
devops
iRules
LTM
security

2 Replies

  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    Feb 17, 2014

    Are you asking how to read (and validate) values from a cookie that is sent by the client?

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Feb 18, 2014

    Here's just one way to do it:

    when HTTP_REQUEST {
    if { ( [HTTP::cookie exists MYCOOKIE] ) and ( [HTTP::cookie value MYCOOKIE] matches_regex {\d{6}-[0-9A-F]{8}\d{8}} ) } {
        log local0. "match"
    } else {
        log local0. "not match"
    }
}

    The matches_regex {\d{6}-[0-9A-F]{8}\d{8}} function would validate any value that starts with 6 digits, then a hyphen, then 8 hexadecimal values (0-9A-F), and followed by 6 digits.