Forum Discussion

Gary_Robb_20023's avatar
Gary_Robb_20023
Icon for Nimbostratus rankNimbostratus
May 04, 2015

Irules for html sanitization

Hi I'm new to irules so forgive me if this is totally bad idea to even consider doing...but is it possible to scan the inbound users Post data for malicious tags?

 

application delivery
devops
iRules

1 Reply

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    May 05, 2015

    Hi Gary,

     

    It is indeed a bad idea as you will be using a wrong tool for the job.

     

    You should really be using the F5 ASM module to protect your applications - it is designed to address security issues like the one you are trying to solve with all the problem confirmation/attack signature updates/reporting/logging etc...

     

    Of course it is possible to scrub the POST data in iRules, but it is not easy to design and develop by someone who is new to iRules. I am also sure your security requirements will not stop at sanitizing the POST data for just SCRIPT tags - there are thousands of attacks and evasion techniques out there and you will not be able to maintain an iRule which can mitigate them all and will keep itself updated of all the latest attack methods and malicious tags. Get ASM.

     

    Hope this helps,

     

    Sam