For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

saidshow_251381's avatar
saidshow_251381
Icon for Cirrostratus rankCirrostratus
Aug 30, 2017
Solved

Turn off File type check for a specific URL

Hi, we have some dynamic urls that from time to time will include a fullstop. Is is possible to disable only the illegal file type check for uris that start with "/foo/foo1/"? I would not want to dis...
ASM Advanced WAF
file
fullstop
illegal
period
security
type
unblock
  • saidshow_251381's avatar
    saidshow_251381
    Aug 30, 2017
    when ASM_REQUEST_DONE {

if { [HTTP::uri] starts_with "/&siteid=" && [ASM::violation count] < 5 } { 
    if { [ASM::violation_data] contains "VIOLATION_OBJ_TYPE"} { 
        ASM::unblock 
    } 
} else { 
     More than one violation, too dangerous to Unblock return 
} 
}

    I have made only minor modification to what Arnaud has done here: https://devcentral.f5.com/questions/irule-for-asm

Stanislas_Piro2's avatar
Stanislas_Piro2
Icon for Cumulonimbus rankCumulonimbus
Aug 30, 2017

Hi,

 

you can create 2 ASM policies:

 

  • one with no file type blocking
  • one with file type blocking and list configured.

one the LTM policy enabling the ASM policy, create a new rule above with condition "/foo/foo1/" and assign the no file type blocking ASM policy.

 

If you are working in version 13 , you can create a policy as parent and both ASM policies are child policies of the parent. this allow to configure only one policy.