# Turn off File type check for a specific URL

**URL:** <https://community.f5.com/t/turn-off-file-type-check-for-a-specific-url/13714>\
**Category:** Technical Forums\
**Tags:** asm-advanced-waf, unblock, security, file\
**Created:** [August 30, 2017, 2:41am UTC](https://community.f5.com/t/turn-off-file-type-check-for-a-specific-url/13714 "2017-08-30T02:41:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![saidshow\_251381](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@saidshow\_251381](https://community.f5.com/u/saidshow_251381)\
**Post date:** [August 30, 2017, 2:41am UTC](https://community.f5.com/t/turn-off-file-type-check-for-a-specific-url/13714/1 "2017-08-30T02:41:12Z")

</div>

Hi, we have some dynamic urls that from time to time will include a fullstop. Is is possible to disable only the illegal file type check for uris that start with “/foo/foo1/”? I would not want to disable ASM entirely, just the illegal file type check.

Or if there is another way to deal with this scenario to prevent client selections with fullstop in it from being interpreted as an illegal file type, it would be great to hear how others are working with this type of scenario. Thank you.

---

<div class="post-metadata">

**Author:** ![nag\_54823](https://avatars.discourse-cdn.com/v4/letter/n/34f0e0/32.png) [@nag\_54823](https://community.f5.com/u/nag_54823)\
**Post date:** [August 30, 2017, 1:18pm UTC](https://community.f5.com/t/turn-off-file-type-check-for-a-specific-url/13714/2 "2017-08-30T13:18:30Z")

</div>

Hi , You can achieve it through irule . Make sure you enable Trigger ASM iRule Events in ASM policy.

```tcl
when ASM_REQUEST_DONE {

```

if {([HTTP::host] equals “[test.test.com](http://test.test.com)”) and ([string tolower [HTTP::uri]] contains “.exe”) and ([ASM::violation\_data] contains “VIOLATION\_OBJ\_TYPE” ) } { ASM::unblock } }

---

<div class="post-metadata">

**Author:** ![stan\_piron](https://avatars.discourse-cdn.com/v4/letter/s/7bcc69/32.png) [@stan\_piron](https://community.f5.com/u/stan_piron)\
**Post date:** [August 30, 2017, 2:31pm UTC](https://community.f5.com/t/turn-off-file-type-check-for-a-specific-url/13714/3 "2017-08-30T14:31:23Z")

</div>

Hi,

you can create 2 ASM policies:

- one with no file type blocking
- one with file type blocking and list configured.

one the LTM policy enabling the ASM policy, create a new rule above with condition “/foo/foo1/” and assign the no file type blocking ASM policy.

If you are working in version 13 , you can create a policy as parent and both ASM policies are child policies of the parent. this allow to configure only one policy.

---

<div class="post-metadata">

**Author:** ![saidshow\_251381](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@saidshow\_251381](https://community.f5.com/u/saidshow_251381)\
**Post date:** [August 30, 2017, 10:34pm UTC](https://community.f5.com/t/turn-off-file-type-check-for-a-specific-url/13714/4 "2017-08-30T22:34:28Z")

</div>

Hi nag, I like this iRule. What you have there does look like it would only prevent blocking on a specific file type such as “.exe” in your example. Since the requests I am looking at that are referral ids, they may be something like “adsa.cchh3” or “0.87dsajb232.adsa” and details past the “.” are always unique as a result I don’t expect that this would work.

The URI does start with &siteid=, however I do not want to completely disable ASM such as I am doing with the iRule below.

```tcl
when HTTP_REQUEST {
    if { [HTTP::uri] starts_with "/&siteid=" } {
        ASM::disable
    } 
}

```

I would prefer to just disable the illegal file type check however I am unsure of the violation type. I will work on this - I will print everything to screen so that I find the details. Thank you for your help.

---

<div class="post-metadata">

**Author:** ![saidshow\_251381](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@saidshow\_251381](https://community.f5.com/u/saidshow_251381)\
**Post date:** [August 30, 2017, 11:26pm UTC](https://community.f5.com/t/turn-off-file-type-check-for-a-specific-url/13714/5 "2017-08-30T23:26:59Z")

</div>

```tcl
when ASM_REQUEST_DONE {

if { [HTTP::uri] starts_with "/&siteid=" && [ASM::violation count] < 5 } { 
    if { [ASM::violation_data] contains "VIOLATION_OBJ_TYPE"} { 
        ASM::unblock 
    } 
} else { 
     More than one violation, too dangerous to Unblock return 
} 
}

```

I have made only minor modification to what Arnaud has done here: [https://devcentral.f5.com/questions/irule-for-asm](https://devcentral.f5.com/questions/irule-for-asm)

---

<div class="post-metadata">

**Author:** ![Noushad\_Vellad1](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@Noushad\_Vellad1](https://community.f5.com/u/Noushad_Vellad1)\
**Post date:** [November 29, 2018, 7:50am UTC](https://community.f5.com/t/turn-off-file-type-check-for-a-specific-url/13714/6 "2018-11-29T07:50:12Z")

</div>

I used the irule specified by saidshow. ASM::unblock indeed unblocks the request. However it is also generating an event log. Is there anyway to disable event log also?

---

<div class="post-metadata">

**Author:** ![Abed\_AL-R](https://avatars.discourse-cdn.com/v4/letter/a/58956e/32.png) [@Abed\_AL-R](https://community.f5.com/u/Abed_AL-R)\
**Post date:** [June 8, 2020, 9:10am UTC](https://community.f5.com/t/turn-off-file-type-check-for-a-specific-url/13714/7 "2020-06-08T09:10:19Z")

</div>

Great irule

But I think you meant by counting violations this:

```tcl
[ASM::violation count] <= 1

```

not:

```tcl
ASM::violation count] < 5

```