Forum Discussion

saidshow_251381's avatar
saidshow_251381
Icon for Cirrostratus rankCirrostratus
Aug 30, 2017

Turn off File type check for a specific URL

Hi, we have some dynamic urls that from time to time will include a fullstop. Is is possible to disable only the illegal file type check for uris that start with "/foo/foo1/"? I would not want to dis...
ASM Advanced WAF
file
fullstop
illegal
period
security
type
  • saidshow_251381's avatar
    saidshow_251381
    Aug 30, 2017
    when ASM_REQUEST_DONE {

if { [HTTP::uri] starts_with "/&siteid=" && [ASM::violation count] < 5 } { 
    if { [ASM::violation_data] contains "VIOLATION_OBJ_TYPE"} { 
        ASM::unblock 
    } 
} else { 
     More than one violation, too dangerous to Unblock return 
} 
}

    I have made only minor modification to what Arnaud has done here: https://devcentral.f5.com/questions/irule-for-asm

saidshow_251381's avatar
saidshow_251381
Icon for Cirrostratus rankCirrostratus
Aug 30, 2017
when ASM_REQUEST_DONE {

if { [HTTP::uri] starts_with "/&siteid=" && [ASM::violation count] < 5 } { 
    if { [ASM::violation_data] contains "VIOLATION_OBJ_TYPE"} { 
        ASM::unblock 
    } 
} else { 
     More than one violation, too dangerous to Unblock return 
} 
}

I have made only minor modification to what Arnaud has done here: https://devcentral.f5.com/questions/irule-for-asm

  • Abed_AL-R's avatar
    Abed_AL-R
    Icon for Cirrostratus rankCirrostratus
    Jun 08, 2020

    Great irule

    But I think you meant by counting violations this:

    [ASM::violation count] <= 1

    not:

    ASM::violation count] < 5