Can I restrict a parameter's value by length or regex pattern (Value length / Value pattern)?

Short answer

Yes; the value can be restricted at two levels. The … value length and … value pattern fields in the common rule of the section (e.g. Query Value Length, Query Value Pattern) are applied to the values of all names that do not have their own argument rule; the same fields in the argument rule opened for a single name are applied only to that name and replace the value inspections of the common rule for that name. The length is applied to each value separately, over the byte count of its raw form. The pattern is a positive inspection: if the value does not match the pattern, a 24-point violation is produced in the Structure Policies category; the pattern is searched anywhere in the value, ^ and $ are required for a full match, and the aA button removes the uppercase/lowercase distinction. In JSON and Xml, only text values are inspected. The inspections depend on the Structure Checks switch in the Checks window.

Problem: A Parameter Receives Unexpected Values

Text arrives in a numeric ID field, and long strings in a short code field. Signature scanning catches only known attack patterns; it does not inspect whether the value is in the expected format. The length and format of the value are to be limited per parameter.

Solution: Three Methods

Methods 1 and 2 differ in scope; the two can be used together on the same tab. Method 3 is the command line counterpart of Method 1.

Your situation	Suitable method
Only the value of one parameter will be restricted	Method 1: Argument rule
A common limit will be put on the values of all parameters in the section	Method 2: Common rule
I want to do it with a script or the command line	Method 3: WEB-CLI

Method 1: Argument Rule Recommended

• How it works Its own value inspections are defined for the selected name; the values of that name are inspected only with this rule.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → tab → Add Argument Rule for …
• RequirementStructure Checks on
• vService type WAF-enabled HTTP vService
• Sections Query, Header, JSON, Xml, Form (there is no argument rule on the Path and Raw tabs)

Step-by-Step Configuration

1

Adım 1 Open the Checks window (if needed)

Structure Checks comes on when WAF is turned on; if it has been turned off, in the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Checks card in the Inspection & Blocking section is clicked (Checks Edit screen).

2

Adım 2 Turn on Structure Checks

Structure Checks is switched to the on position. While the switch is off, the value fields are hidden in the form and in the panel.

3

Adım 3 Save the Checks setting

Edit is clicked.

4

Adım 4 Open the Page Types list

On the WAF Management tab, the N page types row of the host group is clicked (accessing the Page Types screen).

5

Adım 5 Select the page type

The row of the page type is clicked in the list; the detail panel of the rule opens on the right (accessing the panel). If there is no page type, it is added first (How do I add a new page type manually?).

6

Adım 6 Open the tab

The tab of the section where the parameter is (Query, Header, JSON, Xml or Form) is clicked.

7

Adım 7 Open the argument rule form

Add Argument Rule for … above the variable table is clicked (Add Argument Rule for Query screen). If the name is already written in bold in the table, the row is clicked and Edit is used; a second rule cannot be added with the same name. The form opens filled with the common values of the Any paths rule in that section.

8

Adım 8 Enter the name

The name of the parameter is written in the Argument Name box: in Query and Form, in its raw form as in the request; in Header, the header name in lowercase (it is also converted to lowercase on save; a name written in uppercase can create a second rule for the same header); in JSON, the dotted key path (user.name); in Xml, the element or attribute path (user._attr.type). The name cannot be changed later.

9

Adım 9 Enter the value inspections

For … value length, an operator and a value are selected (e.g. Less than or Equal to 8). The pattern is written in the … value pattern box (e.g. ^[0-9]+$); if the uppercase/lowercase distinction does not matter, the aA button on the left of the box is activated. The pattern is compiled and validated before it is saved, and it can be tried on sample values with the test icon on its right (Which regex syntax is supported in custom rules (backreference, lookaround); can I test a rule before saving it?). The other fields in the form (OWASP Check, Detailed Log, … value count) also apply to this name; a field left empty means no restriction for that inspection.

10

Adım 10 Save

Add (Edit when editing) is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Value that does not match the patternClient side

While the host group is in Blocking mode, a request is sent with a value that does not match the pattern.

Command: curl -s -o /dev/null -w "%{http_code}\n" "https://www.example.com/urun?id=12a"

Expected418

?id=12345678 passes; ?id=123456789 is blocked because it exceeds the length limit. In Monitor mode, the requests pass and the violation is only recorded.

2Event LogsTR7 side

The Attacks tab of the Event Logs record is checked.

ExpectedAttack area: Query@id · Attack name: Query value pattern; Description: 12a

Method 2: Common Rule

• How it works The value fields in the common rule are applied to the values of all names in the section that do not have their own argument rule.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → tab → Add Common Rule for …
• RequirementStructure Checks on
• vService type WAF-enabled HTTP vService
• Out of scope Names that have their own argument rule (e.g. the default header rules in the Any paths rule)

Step-by-Step Configuration

1

Adım 1 Open the Page Types list

While Structure Checks is on (Method 1, steps 1–3), the N page types row of the host group is clicked on the WAF Management tab.

2

Adım 2 Select the page type

The row of the page type is clicked in the list; the detail panel opens on the right.

3

Adım 3 Open the tab

The tab of the section is clicked.

4

Adım 4 Open the common rule form

Add Common Rule for … is clicked; if the rule has its own common rule for that section, the button appears as Edit Common Rule for ….

5

Adım 5 Enter the value inspections

The … value length and … value pattern fields are filled in. Since the pattern in the common rule will be applied to all values in the section, only a pattern that all of them will match is written.

6

Adım 6 Save

Add (Edit when editing) is clicked.

Verification

1Detail panelTR7 side

The … value length and … value pattern rows of the common rule are checked in the related tab of the rule.

ExpectedThe entered limit and pattern; if aA is on, (-i) next to the pattern

Method 3: WEB-CLI

• How it works The argument rule in Method 1 is added with WEB-CLI by giving the --arg field.
• Where it is opened WEB-CLI → waf rule-parts add
• Requirement WEB-CLI access; Structure Checks on (waf options update poolId <vService> --syncWithDefaultFwRules false --structureChecks true)
• vService type WAF-enabled HTTP vService
• Pre-fill difference The command's defaults, not the Any paths values, are written to the fields that are not written (valueLength 0–1024, argOwasp on); case insensitivity is turned on from the interface

Step-by-Step Configuration

1

Adım 1 Find the rule ID

The ID of the default host group is defaultHost; rule IDs are listed in the id column:

waf fw-rules list poolId <vService> hostGroupId defaultHost

2

Adım 2 Add the argument rule

The pattern is written in single quotes (fields common to every region). If there is a rule with the same name, the command is rejected; in that case, the ID of the part is found with waf rule-parts list and update … id <part> is used:

waf rule-parts add poolId <vService> hostGroupId defaultHost ruleId <rule> loc query --arg id --valueLength.op "<=" --valueLength.val 8 --argRegex.input '^[0-9]+$'

Verification

1Part listTR7 side

The parts of the rule are listed.

Command: waf rule-parts list poolId <vService> hostGroupId defaultHost ruleId <rule>

Expectedquery: id

A request made with a value that does not match the pattern is blocked as in Method 1.

Common Mistakes

• Not writing ^ and $. The pattern is searched anywhere in the value; the [0-9]+ pattern also accepts the ab12 value.
• Leaving the other fields empty in the argument rule and thinking that the common limits continue. The argument rule replaces the value inspections of the common rule for that name; a … value count left empty removes the repetition limit (How do inheritance and "Rule Source" work in rules?).
• Writing an unsupported regex. Backreferences and lookarounds are not supported; before saving the pattern, the form compiles it with the settings WAF uses in traffic and shows the error below the field. Unlike custom rule patterns, value patterns accept anchored patterns that can also match an empty value, such as ^[a-z]*$ (Which regex syntax is supported in custom rules (backreference, lookaround); can I test a rule before saving it?).
• Writing a pattern for a numeric JSON value. In JSON and Xml, the length and the pattern are applied only to text values; the number in the {"id":123} body does not go into these inspections.
• Trying a strict pattern directly in Blocking mode. A new pattern is first monitored in Monitor mode; if legitimate values produce violations, the pattern is widened (WAF modes).

How it is done in the documentation

• Query · Query Value Pattern
• Query · Query Value Length
• Query · The Add Argument Rule for Query Screen
• WEB-CLI waf rule-parts · The Fields Common to Every Region

Related questions

• Which regex syntax is supported in custom rules (backreference, lookaround); can I test a rule before saving it?
• How do inheritance and "Rule Source" work in rules?
• Can I limit how many times the same parameter may repeat (Value count)?