For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ScottE's avatar
Mar 13, 2008

iRule to strip out a query variable

 

I'm building an iRule that strips off one of the query variables, namely "_". From the logs and documentation this _should_work but it is NOT setting the HTTP::uri as anticipated.

 

 

F5: BIG-IP 9.2.4 Build 13.1

 

---------------------------------------------------------------------

 

when HTTP_REQUEST {

 

if {[HTTP::query] contains "&_="} {

 

log local0. "--------------------------"

 

log local0. "HTTP::uri: [HTTP::uri]"

 

log local0. "HTTP::query: [HTTP::query]"

 

set newquery ""

 

set namevals [split [HTTP::query] "&"]

 

for {set i 0} {$i < [llength $namevals]} {incr i} {

 

set params [split [lindex $namevals $i] "="]

 

set pnum {$i+1}

 

if {[lindex $params 0] != "_"} {

 

 

only prepend a & when not the first variable

 

if { $newquery contains "&" } {

 

append newquery "&"

 

}

 

 

add variable and value to newquery

 

append newquery [lindex $params 0] "=" [lindex $params 1]

 

}

 

}

 

log local0. "new query string $newquery"

 

 

rebuild new uri with path and query string

 

set newuri [HTTP::path]

 

append newuri "?" $newquery

 

log local0. "new uri: $newuri"

 

 

set the uri request to the new one

 

HTTP::uri $newuri

 

log local0. "new HTTP::uri: [HTTP::uri]"

 

log local0. "--------------------------"

 

}

 

}

 

----------------------------------------------------------------------------

 

 

Example logs:

 

-----------------------------------------------------------------------------

 

Mar 13 12:59:20 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : HTTP::uri: /cp/wu/as?getAlertMessage=true&_=1205438360315

 

Mar 13 12:59:20 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : HTTP::query: getAlertMessage=true&_=1205438360315

 

Mar 13 12:59:20 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : new query string getAlertMessage=true

 

Mar 13 12:59:20 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : new uri: /cp/wu/as?getAlertMessage=true

 

Mar 13 12:59:20 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : new HTTP::uri: /cp/wu/as?getAlertMessage=true&_=1205438360315

 

Mar 13 12:59:20 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : --------------------------

 

Mar 13 13:05:10 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : --------------------------

 

Mar 13 13:05:10 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : HTTP::uri: /cp/wu/as?getAlertMessage=true&_=1205438710749

 

Mar 13 13:05:10 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : HTTP::query: getAlertMessage=true&_=1205438710749

 

Mar 13 13:05:10 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : new query string getAlertMessage=true

 

Mar 13 13:05:10 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : new uri: /cp/wu/as?getAlertMessage=true

 

Mar 13 13:05:10 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : new HTTP::uri: /cp/wu/as?getAlertMessage=true&_=1205438710749

 

Mar 13 13:05:10 tmm tmm[1034]: Rule dev.usource.uvic.ca_strip_query_variable : --------------------------

 

 

 

The iRule line that is NOT working seems to be:

 

 

HTTP::uri $newuri

 

 

 

What is not correct about that?

 

 

Thanks

 

 

Scott Campbell
No RepliesBe the first to reply