Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Can I allow only certain MIME types in file uploads?
Short answer
Yes. The Allowed Upload Mime Types list in the common rule of the Form tab determines the allowed types of the files uploaded with a multipart/form-data body. The type is detected not from the Content-Type the client declares but from the content of the file, together with the file name extension when needed; list entries match the detected type as a substring (the image entry covers all image types) and are written in lowercase. While the list is in the No Restriction position, there is no restriction; every file that does not comply with the list produces a 24-point violation in the Structure Policies category, and the detected type appears in the record. Any Paths comes with a ready list of 14 types. The inspection is independent of the main switches in the Checks window and exists only in the common rule.
Problem: Unexpected File Types Arrive at the Upload Form
An upload form should accept only images or PDFs; executable files, scripts or files whose extension has been changed should not reach the application. Since the Content-Type the client declares and the file name can easily be changed, the type is to be inspected from the content.
Solution: Two Methods
The two methods write the same list; one of them is selected.
| Your situation | Suitable method |
|---|---|
| I want to make the setting from the interface | Method 1: Form common rule |
| I want to do it with a script or the command line | Method 2: WEB-CLI |
Method 1: Form Common Rule Recommended
- How it works The type of every file in the multipart body is detected from the content, and if it does not contain one of the entries in the list, a violation is written.
- Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Form → Add Common Rule for Form
- Requirement No main switch is required; the host group in Blocking or Monitor mode
- vService type WAF-enabled HTTP vService
- Any Paths default
application/octet-stream,application/pdf,text/plain,text/csv,application/json,application/zip,image/jpeg,image/png,image/gif,image/webp,image/svg+xmland three Office Open XML types
Step-by-Step Configuration
1
Adım 1 Open the Page Types list
In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the N page types row of the host group is clicked (accessing the Page Types screen).
2
Adım 2 Select the page type
The page type of the path the upload form is submitted to is clicked; the detail panel opens on the right (accessing the panel). If there is no page type, it is added first (How do I add a new page type manually?).
3
Adım 3 Open the Form tab
The Form tab is clicked in the tab strip of the panel.
4
Adım 4 Open the common rule form
Add Common Rule for Form is clicked; if the rule has its own Form common rule, the button appears as Edit Common Rule for Form (Add Common Rule for Form screen). The add form opens filled with the Form values of the Any Paths rule (the list of 14 types included).
5
Adım 5 Write the types
The Allowed Upload Mime Types list is kept in the Restrict position; the types that will not be allowed are deleted from the list and the required types are added as separate items (e.g. image/png, image/jpeg, application/pdf). Entries are written in lowercase; a short entry such as image covers all image types.
6
Adım 6 Save
Add (Edit when editing) is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.
File contents also go through signature scanning; this scanning is managed with the OWASP Check in Upload box in the same form (Is the content of uploaded files scanned as well (OWASP Check in Upload)?).
Verification
1Disallowed typeClient side
While the host group is in Blocking mode, a file of a type that is not in the list is uploaded with its extension and Content-Type made to look like an image.
Command: curl -s -o /dev/null -w "%{http_code}\n" -F "dosya=@setup.exe;filename=resim.png;type=image/png" https://www.example.com/upload
Expected
418418 is the Blocking Status Code default. In Monitor mode, the request passes and the violation is only recorded.
2Event LogsTR7 side
The Attacks tab of the Event Logs record is checked.
Expected
Attack name: Allowed upload mime types; Description: the detected type (e.g. application/octet-stream)Method 2: WEB-CLI
- How it works The list is written with WEB-CLI to the
formAllowedMimeTypesfield in the Form common part of the rule. - Where it is opened WEB-CLI →
waf rule-parts - Requirement WEB-CLI access
- vService type WAF-enabled HTTP vService
- List behavior
--formAllowedMimeTypes.Nreplaces the existing type at that position; the types at the positions that are not written stay in the list
Step-by-Step Configuration
1
Adım 1 Find the rule ID
The ID of the default host group is defaultHost; rule IDs are listed in the id column:
text
waf fw-rules list poolId <vService> hostGroupId defaultHost2
Adım 2 List the parts of the rule
The row that shows form: (all keys) in the description column is the Form common part:
text
waf rule-parts list poolId <vService> hostGroupId defaultHost ruleId <rule>3
Adım 3 Add it with the list if there is no common part
Since the formBlockAll default is on in the add command, --formBlockAll false is given; the other fields are written with the command's defaults (formKeyCount ≤ 32, formBlockInvalid on, valueLength 0–1024):
text
waf rule-parts add poolId <vService> hostGroupId defaultHost ruleId <rule> loc form --formBlockAll false --formAllowedMimeTypes.0 image/png --formAllowedMimeTypes.1 image/jpeg --formAllowedMimeTypes.2 application/pdf4
Adım 4 If there is a common part, see the existing list
The formAllowedMimeTypes.0 … lines in the output are the existing list:
text
waf rule-parts show poolId <vService> hostGroupId defaultHost ruleId <rule> <part>5
Adım 5 Add the type to the first empty position
If the list carries, for example, three types, the new type is added with --formAllowedMimeTypes.3; writing to an existing position changes the type there:
text
waf rule-parts update poolId <vService> hostGroupId defaultHost ruleId <rule> id <part> --formAllowedMimeTypes.3 image/webpVerification
1Part recordTR7 side
The part is displayed again.
Command: waf rule-parts show poolId <vService> hostGroupId defaultHost ruleId <rule> <part>
Expected
The allowed types in the formAllowedMimeTypes linesCommon Mistakes
- Writing an
image/*wildcard. There is no wildcard; the entry is searched in the detected type as a substring. For all images,imageis written; this entry also covers theimage/svg+xmltype. - Leaving the
application/octet-streamentry on a restricted upload page. Unrecognized binary files and.exefiles are detected with this type; this entry, which comes from the Any Paths list, is deleted from the list on a page where only specific types are to be accepted. - Relying on the extension or the client's
Content-Type. The type is detected from the content; the type the client declares is not inspected (Does the file type check look at the client's Content-Type or at the file's content?). - Assuming that the detected name is the same as the name the client declares. Some files are detected with a different name (e.g. a
.docxfile asapplication/msword). The detected type of a blocked legitimate file is seen in the Description field of the violation record; the list is completed with this name, or the record is taught from Event Logs. - Expecting a type inspection on files that exceed the processable size. Bodies that exceed the body processing limit are not parsed; what happens to them is determined by Block Unparsed Contents in the Raw tab (What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?).
How it is done in the documentation
