Matching ASCII codes %00 - %1f in HTTP::uri

I am not an expert-level iRuler at this point (yet), so someone may have a better, more direct answer, but... I would add the "log" lines below. The output will show in the "Local Traffic" log (or /var/log/ltm on the F5 itself). It will give you a better idea of what is going on.

I did find a package that is supposed to "test iRules" but it isn't quite very intuitive (from what I have seen so far).

when HTTP_REQUEST {
    log local0. "Checking URI: [HTTP::uri]"
    if { [HTTP::uri] contains "%00" } {
        log local0. "Illegal URI: Closing Connection."
        HTTP::close
        TCP::close
    }
}

And actually, if you wanted to trap ALL of the control characters from %00 to %1f...

Note that %1, %2, etc would pass through unmatched as the regex is looking for percent, followed by single digit 0 or 1, followed by single digit 0 through 9 or a though f or A through F.

when HTTP_REQUEST {
    log local0. "Checking URI: [HTTP::uri]"
    if { [regexp {%[0-1][0-9a-fA-F]} [HTTP::uri]] } {
        log local0. "Illegal URI: Closing Connection."
        HTTP::close
        TCP::close
    }
}

The browser was stripping the ASCII device control characters in URLs I tested after the first request. Then loading from browser cache after that. No way to force with shift-reload when that happens. The code worked every time when using curl or wget to test the offensive URLs.