Forum Discussion

StewartT_232774's avatar
StewartT_232774
Icon for Nimbostratus rankNimbostratus
Apr 12, 2019

Email Addresses as part of URL?

I have a customer that is using email addresses as part of a URL path. This causes a few issues with file types, requiring me to allow things like .com (which I would prefer to block as executable)....
ASM Advanced WAF
security
Yoann_Le_Corvi1's avatar
Yoann_Le_Corvi1
Icon for Cumulonimbus rankCumulonimbus
Apr 12, 2019

Hi

 

What I have used in the past for that is the ASM::unblock

 

With a more precise regex, match the URL with email addresses (send us an example if you want I'll try to help with the regex 🙂 ), and for thos URL, if a violation of type ILLEGAL FILE TYPE is triggered then unblock it.

 

An exemple in my code :

 

if { $uri starts_with "/app/rpc"} {
    if { $asmviolation equals "VIOLATION_ATTACK_SIGNATURE_DETECTED"  || $asmviolation equals "VIOLATION_METACHAR_IN_DEF_PARAM"} {
        log local0. "DEBUG!! ASM EXCEPTION - ALLOW $uri - VIOLATION : $asmviolation"
        ASM::unblock
        }
}

You can also group your exceptions regex in a datagroup.

 

Hope this helps.