Regex issue

[Darius44]

Hello,

I am stuck on trying to find out how to match some parameters in a WAF request using regex wildcard

The parameters that I want to match are int the form of amp;arg20=something where the arg20 can be anything.

The repetitive part that I want to match with the regex is amp; and I want to match multiple times because it appears multiple times in the query string

This is the request 

GET /human.aspx?r=2900376326&arg20=dssdds&arg21=aaa HTTP/1.1

 I want to match the 2 parameters amp;arg20 and amp;arg21 with a wildcard which appears as invalid parameters

Parameter Location	Query String
Parameter Name	amp;arg20
Parameter Value	dssdds
Applied Blocking Settings	Block Alarm Learn

---

Parameter Location	Query String
Parameter Name	amp;arg21
Parameter Value	aaa
Applied Blocking Settings	Block Alarm Learn

I tried to create multiple wildcard parameters like: amp.* or amp.+?(?==) but the parameters never match and I get the illegal parameter violation

How can this be achieved?

[Darius44]

I attahced the wildcard parameter entry that I have created

[Niels_van_Sluis]

You can try this:

amp;arg2[01]

This site can help you test your regular expressions:

regex101: build, test, and debug regex

[Darius44]

Hello,

Thank you for your answer.

I tried it and it still doesn't work.

Anyway there is the posibility that the parameters in the request will be amp;Arg02 or amp;arg100 or even amp;Opt10

The regex in my opinnion should match any parameter that starts with this string amp; and then anything else untill the = sign

I also tried it on the regex website and even on the f5 regex tester and the regex appears to be ok but when I try to use it in the policy it fails

[Niels_van_Sluis]

This?

amp;[a-zA-Z0-9]+=

[Darius44]

Same

Just to be sure that I am doing it correctly I attached the parameter creation page and the error that I get

[Darius44 · Accepted solution]

I somehow got it to work with this solution (not sure why it wasn't working before)

amp;[a-zA-Z0-9]*

[Niels_van_Sluis]

Nice!