Regex in iRule

Question

Im making a rule to catch bad code being in HTTP POST.&nbsp;
for some reason we have some sites trying to do some sort of XSS attack, but posting URL strings in the POST and then they get a 500error.  Im trying to right a rule but cant get it sorted out.&nbsp;
 &nbsp;
when RULE_INIT {&nbsp;
   set ::vDebug 1&nbsp;
}&nbsp;
when HTTP_REQUEST {&nbsp;
 if { [HTTP::query] matches_regex {&lt;[a-zA-Z!]} } {&nbsp;
  if { $::vDebug } {&nbsp;
      log local0. "Triggered by IP [IP::client_addr] with URI [HTTP::uri]"&nbsp;
   }&nbsp;
         reject&nbsp;
         }&nbsp;
 }&nbsp;
 &nbsp;
Not sure if Im even in the right ballpark on this one, I just want to catch in HTTP POST, not every connection.&nbsp;
Please see below for possible samples:&nbsp;
"&nbsp;
"&nbsp;
"&nbsp;
Thanks&nbsp;

mohamed_lrhazi · Answer

If you're asking how do I detect POST, then the answer is: https://devcentral.f5.com/wiki/iRules.http__method.ashx 
&nbsp;  
&nbsp; See Sample Code links bellow for examples. 
&nbsp;  
&nbsp; Thanks, 
&nbsp; Mohamed.

kevin_stewart · Answer

Here's a rough example:

when HTTP_REQUEST {
if { [HTTP::method] equals "POST" } {
log local0. "query = [URI::decode [HTTP::query]]"

if { [string match -nocase {*&lt;[a-zA-Z!]*} [URI::decode [HTTP::query]]] } {
log local0. "Gotcha!"
reject
}
}
}

In the above example I'm URI decoding the HTTP query in POST requests, which will catch URI encoding of the &lt; character.

f5hopper_28651 · Answer

ok thanks, I will check that out and post if that worked.

f5hopper_28651 · Answer

I just noticed that my samples didnt show in my main post. Im looking for samples in attached TXT file.&nbsp;
Kevin, I tryied your rule, I changed the log to, log local0. "Gotcha![IP::client_addr] with URI [HTTP::uri]"&nbsp;
&nbsp;
Im not sure if its working or not... I get these in my log for EVENT&nbsp;
Rule test-regex : query = Step=2&nbsp;
Rule test-regex : query =&nbsp;
Rule test-regex : query = Step=4&nbsp;
Rule test-regex : query = Step=3&nbsp;
&nbsp;
No gotcha! or client_addr. what do you make of that?&nbsp;

brian_69413 · Answer

Your session is probably still tied to the old version of the iRule

Forum Discussion

Regex in iRule

9 Replies

Recent Discussions

Unwinding the Benefits of Investing in White Label Crypto Wallet

SMTP profile not visible & showing

About AWAF "Redirect URLs" in "Responses and Blocks"

F5 iRule to replace host to path

Chrome V 124+ on MacOS - Virtual Server Access Issue

Related Content

Regex issue

Regex for dynamic URI

Delete Cookie From Request By Regex

How to replace [HTTP::host] using regex

Handy Reference: RegEx in the Network