ASM - Block Extension @ File upload

Question

I want to block any extension from being uploaded to my Website , i want to allow only   ".pdf" extension to be uploaded .
I cann't used allowed / Disallowed file types as this looks on URI , am i right ?
File upload here is @ a parameter called  "FileGet " ...  how to do that ? regular expression under parameter or what ?&nbsp;

mike_maher · Answer

Use a regular expression to control the value of the parameter (if the value is the file name). This should work, and it is easy to add more file extensions if you like, below I am allow for .pdf and .doc. &nbsp;
(?i).(pdf|doc)$&nbsp;
You will probably also have a parameter that is the actual file upload make sure to set that parameter as a file upload value and check the box to say no .exe. I would also recommend using the feature to offload AV scanning of the file to a Scan Engine of some sort. &nbsp;

torti · Answer

To check for an extension is no save way to allow only pdf files. You have to look into the file or a pdf-file can be something else.&nbsp;

torti_93733 · Answer

To check for an extension is no save way to allow only pdf files. You have to look into the file or a pdf-file can be something else.&nbsp;

mike_maher · Answer

Agreed. This is just checking that someone doesn't accidentally submit something else, you want to use the AV integration to check for malicious files.  I am not sure if the the no .exe's check box actually looks at the file or just the extension.

Torti - From a Big-IP standpoint do you have any suggestions on how to check into the file to determine what it really is?  I don't know of any way to do that on the Big-IP but would be interested in any thoughts on the subject.

mike_maher · Answer

Agreed. This is just checking that someone doesn't accidentally submit something else, you want to use the AV integration to check for malicious files.  I am not sure if the the no .exe's check box actually looks at the file or just the extension.

Torti - From a Big-IP standpoint do you have any suggestions on how to check into the file to determine what it really is?  I don't know of any way to do that on the Big-IP but would be interested in any thoughts on the subject.

Forum Discussion

ASM - Block Extension @ File upload

8 Replies

Recent Discussions

F5Access | MacOS Sonoma

Active- Active HA setup

syslog server connection

Cannot see floating MAC address outside of ESXi

Rewrite uri translation not working

Related Content

WAF - Allow uploads of only files with certain extensions and block all other file uploads

F5 CIS, TLS Extensions, and troubleshooting

Can't upload msg file - ASM block

File upload and ASM

File Uploads and ASM