Forum Discussion
Perry_Ler_71437
Nimbostratus
Nimbostratusirule for file type checking
Hi
Anyone can point in the direction to look at? I need an iRule to check the file type that is uploaded through a html form page.
There is HTTP::uri for the action GET but I cannot find anything for action POST.
I read that you have to use the HTTP::collect to look at the payload but within the payload, I still cannot get anything. Even a regex to search for executable is not successful. Anyone here manage to do up an irule that can do that?
I know, this is so much easier to be done on the form page using js or whatever server-side language that the form is written in. Let say I cannot go in that direct.
Thanks in advance.
6 Replies
naladar_65658Altostratus
Have you looked at using HTTP::method equals "POST"
Perry_Ler_71437Hi Naladar
The HTTP::method eq POST is part of the condition. but I need to look beyond it. I need to stop user from uploading exe file. When I look at the HTTP::header, the content-type do not know the executable but it only display out the content type of the html page. So that cannot tell me that an executable file is uploaded.
thanks
perry
hoolioCirrostratus
Hi Perry,
You could try to collect POST request payloads and then parse the payload using regexes, but it's going to a little complicated and could be resource intensive. Here is a post where we discussed the approach:
Parse POST parameters
http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&tpage=1&view=topic&postid=20599
Aaron- Perry_Ler_71437Hi Aaron
Thanks for the link. If I just look at the content type, I can only see something like this:
Content-Type: multipart/form-data; boundary=---------7d83b43a3208ec
if at least I can see the word "executable", then it will be so much easier. i'm trying to do a regex but can't seem to find the right match. - hoolioThe HTTP Content-Type header for a multipart form upload won't reflect the datatypes of any files being uploaded. It will be set to something starting with "multipart/form-data". If you collect the HTTP payload, you could start with a generic check of the entire payload for something like:
if {[HTTP::payload] contains "Content-Type: application/octet-stream"}{
or maybe:
if {[HTTP::payload] contains "Content-Type: application"}{
Aaron - Perry_Ler_71437Hi Hoolio
Thanks for the reply. I was trying that out too before I saw your reply. But I just make it simpler by searching for ".exe" and it works. Of course your suggestion will be more foolproof than mine just using ".exe".
The solution is so much simpler. I kept looking at the difficult angle by trying to do a regex because I found a few article and threads all pointing in regex and binary match direction.
Thanks
Perry
