Is the content of uploaded files scanned as well (OWASP Check in Upload)?

Short answer

Yes, it is scanned by default. While OWASP Check in Upload in the common rule of the Form tab is checked, the content of every file uploaded with multipart/form-data goes through signature scanning with the OWASP settings of the Raw tab (including OWASP Exclusions and Detailed Log); if OWASP Check is off in the Raw tab, the file contents are not scanned. The hits appear in the record with the Raw section and the name of the form field the file was uploaded with. This setting is not shown in the detail panel; it is found only in the form. The file name is scanned as the value of the form field with the OWASP Check setting of the Form tab; the whole multipart body also goes through Raw scanning separately. Uploads that exceed the body processing limit are not scanned; their fate is determined by Block Unparsed Contents.

How Does It Work?

In a multipart request, after the body is parsed, signature scanning is done on three separate inputs:

Scanned	With which setting	Attack area in the record
The whole multipart body	Raw tab OWASP Check	Raw (In multipart requests, is the whole body scanned separately as well?)
The content of every uploaded file	Form tab OWASP Check in Upload and Raw tab OWASP Check (both must be on)	Raw@field-name
The names and values of the form fields (file names included)	Form tab OWASP Check (if there is a field-specific argument rule, its setting)	Form@field-name

• The file content and the whole body are scanned with the OWASP Exclusions list of the Raw tab; whether the matching content is shown in the record depends on the Detailed Log setting of the Raw tab.
• Scanning is done in all modes; a hit blocks the request in the Blocking mode and when the total score reaches the OWASP Protection Level threshold.
• A body that exceeds the body processing limit or is not completed in time is not parsed and not scanned (What happens to request bodies that exceed the Max. Body Size to Process(kB) limit or do not complete in time?).

Configuring in TR7

OWASP Check in Upload is checked by default and is independent of the main switches in the Checks window. To change it:

1. In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the N page types row of the host group is clicked.
2. The row of the page type is clicked; the detail panel opens on the right.
3. The Form tab is clicked.
4. Add Common Rule for Form (Edit Common Rule for Form if the rule has its own Form common rule) is clicked.
5. The OWASP Check in Upload box is checked or unchecked.
6. Add (Edit when editing) is clicked; the change is applied without a separate deployment step and, in a cluster setup, is sent to the peer device with the default auto-sync (manually if Manual Sync Mode is on).

In WEB-CLI, the field is named --formFileOwasp (loc form); the Form common part of the rule is found with waf rule-parts list:

waf rule-parts update poolId <vService> hostGroupId defaultHost ruleId <rule> id <part> --formFileOwasp true

For a signature that produces false positives in file contents, instead of turning the scanning off, that signature is added to the OWASP Exclusions list of the Raw tab (Can I turn off OWASP scanning for a specific parameter?).

Common Misconceptions

• "When an argument rule is opened for the file field and OWASP check is turned off, the file content is not scanned." The OWASP check setting of the argument rule affects the name and the value (the file name) of the field; the file content is scanned with OWASP Check in Upload and the OWASP Check setting of the Raw tab.
• "Turning off OWASP check in the Raw tab affects only raw bodies." If OWASP check is off in the Raw tab, the contents of uploaded files and the whole multipart body are not scanned either.
• "When OWASP check in upload is turned off, uploads are not scanned at all." The box turns off only the separate scanning of the file contents; if OWASP check is on in the Raw tab, the whole multipart body is still scanned.

How it is done in the documentation

• Form · OWASP Check in Upload
• Raw · OWASP Check
• Raw · Runtime: The RAW Inspection Order
• Request Body Limits · Max. Body Size to Process (kB)

Related questions

• In multipart requests, is the whole body scanned separately as well?
• Can I allow only certain MIME types in file uploads?
• What happens to request bodies that exceed the Max. Body Size to Process(kB) limit or do not complete in time?