Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What does the Raw tab inspect; what happens to content that cannot be parsed?
Short answer
Raw is the set of inspections applied to the unparsed state of the request body and consists only of the common rule (What is Raw). Raw Body Size is applied in every request that carries a body, independently of the content type and before the other body inspections; Block Unparsed Contents determines whether a body that exceeds the processable size or is not completed in time is blocked or not; in content types that are not processed as JSON, XML or form, Allowed Raw Body Mime Types performs a type inspection from the content and OWASP Check passes the whole body through signature scanning. Content that cannot be parsed is three separate cases: a body that exceeds the processable size goes to the Block Unparsed Contents decision; a body that declares JSON, XML or form and cannot be parsed produces a violation if Block invalid … contents is checked; a JSON and XML body in every case, and a form body while the box is not checked, goes through signature scanning as raw content; an unexpected error during processing goes to the Block Unexpected Parser Errors setting.
How Does It Work?
| Field | When it is applied | Any paths default |
|---|---|---|
| Raw Body Size | In every request that carries a body, independently of the body type; while Structure Checks is on | 1–268435456 bytes |
| Block Unparsed Contents | When the body exceeds the processable size or is not completed in time | Allow Unparsed Body |
| Block Unexpected Parser Errors | When an unexpected error occurs while the request is being processed | Unchecked |
| Allowed Raw Body Mime Types | In bodies whose Content-Type is not JSON, XML or form; in the Blocking and Monitor modes | text/plain, application/octet-stream |
| OWASP Check, OWASP Exclusions, Detailed Log | In the signature scanning of the whole raw body; these settings are also used in the scanning of uploaded file contents | OWASP check on, Detailed log on |
The processable size is the greater of the vService's Max. Body Size to Process(kB) value and the Buffer Size(kB) value in the vService limits profile; in the Raw tab, it is shown with the Maximum parsable body size information when the Block unparsed contents field is focused.
Content That Cannot Be Parsed
| Situation | What happens |
|---|---|
| The body exceeded the processable size or was not completed in time | If Block Unparsed Body is selected, a 24-point violation in the Content Integrity category; if Allow Unparsed Body is selected, the body passes without being inspected. No other body inspection and no signature scanning is done on these bodies (What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?) |
Content-Type declares JSON or XML, the body could not be parsed | If Block Invalid JSON Contents / Block Invalid XML Contents is checked, a violation; in every case, the body goes through Raw signature scanning as raw content (Can I block malformed (unparseable) JSON / XML / form bodies?) |
Content-Type declares form, the body could not be parsed | If Block Invalid Form Contents is checked, a violation; if it is not checked, the body goes through Raw signature scanning |
| Unexpected error during processing | If Block Unexpected Parser Errors is checked, a 24-point violation; if it is not checked, the remaining inspections are not done and the decision is made with the violations found up to that moment |
- JSON, XML or form bodies that cannot be parsed enter only signature scanning; the Allowed Raw Body Mime Types inspection is applied to bodies whose
Content-Typeis not one of these types. - Even if multipart bodies are parsed successfully, the whole body also goes through Raw signature scanning separately (In multipart requests, is the whole body scanned separately as well?).
- The order of the inspections: What is the Raw inspection order?
The Raw Tab in TR7
Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Raw tab; the fields are changed from the Add common rule for Raw (Edit common rule for Raw if the rule has its own Raw common rule) form (Add Common Rule for Raw screen). The form opened in a page type comes with the Raw values of the Any paths rule. In WEB-CLI, the fields are named rawSize, rawBlockUnparsed, rawBlockUnexpectedError and rawAllowedMimeTypes (loc raw). The change is applied without a separate deployment step; in a cluster setup, it is sent to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent manually.
Common Misconceptions
- "Raw is only for binary bodies." Raw Body Size and Block Unparsed Contents are applied to all bodies, independently of the body type.
- "An argument rule is opened in Raw." The Raw tab has only the common rule; there is no variable table.
- "A body that exceeds the processable size is partially scanned." There is no partial scanning; the body is either blocked with Block Unparsed Body or passes without being inspected with Allow Unparsed Body.
How it is done in the documentation
