Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?
Short answer
Both are in the common rule of the Raw tab and produce a 24-point violation in the Content Integrity category, but they decide on different situations. Block Unparsed Contents is a two-position switch (Block unparsed body / Allow unparsed body): in a request whose body could not be parsed at all because it exceeded the processable size or was not completed in time, Block Unparsed Body produces a violation, and Allow Unparsed Body passes the body without inspecting it. Block Unexpected Parser Errors comes into play when an unexpected error occurs while the request is being processed: if it is checked, a violation is written with the error detail; if it is not checked, the remaining inspections are not done and the decision is made with the violations found up to that moment. In the Any paths rule, Block Unparsed Contents comes as Allow unparsed body and Block Unexpected Parser Errors as unchecked; both settings are independent of the main switches in the Checks window.
Comparison
| Block Unparsed Contents | Block Unexpected Parser Errors | |
|---|---|---|
| Situation | The body exceeded the processable size or was not completed in time | An unexpected error occurred while the request was being processed |
| Positions | Block Unparsed Body · Allow Unparsed Body | Checked · unchecked |
| Block / checked | 24-point violation; body inspections and body scanning are not done | 24-point violation; the error detail is written to the record |
| Allow / unchecked | The body passes without being inspected; the path, query and header inspections have already been done | The remaining inspections are not done; the decision is made with the violations found up to that moment |
| Any paths default | Allow Unparsed Body | Unchecked |
WEB-CLI add default | On (rawBlockUnparsed true) | Off |
- The processable size is the greater of the vService's Max. Body Size to Process(kB) value and the Buffer Size(kB) value in the vService limits profile; it is shown with the Maximum parsable body size information when the Block unparsed contents field is focused (What is the maximum value of Max. body size to process; how does it relate to the log limit?).
- If Wait for body for a time is on, a body that is not completed when the time runs out is also counted as unparsable (What is "Wait for body for a time" for?).
- Both records block the request only in the Blocking mode; in the Monitor mode, they are recorded as violations.
Configuring in TR7
In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Raw tab → Add common rule for Raw (Edit common rule for Raw if the rule has its own Raw common rule) path, the Block unparsed contents switch and the Block unexpected parser errors box are set, and the form is saved with Add / Edit. The form opened in a page type comes with the Raw values of the Any paths rule. In WEB-CLI, the fields are named --rawBlockUnparsed and --rawBlockUnexpectedError (loc raw). The change is applied without a separate deployment step; in a cluster setup, it is sent to the peer device with the default auto-sync, and if Manual Sync Mode is on, it is sent manually.
On paths where large file uploads are not expected, bodies that exceed the processable size are prevented from passing uninspected by selecting Block Unparsed Body; on paths that receive large uploads, the processable size is increased with Max. Body Size to Process(kB).
Common Misconceptions
- "Allow unparsed body partially scans the large body." There is no partial scanning; the body passes without being inspected at all.
- "Block unexpected parser errors catches malformed JSON." A JSON, XML or form body that cannot be parsed in the declared type is the subject of the Block Invalid … Contents fields (Can I block malformed (unparseable) JSON / XML / form bodies?).
- "Block unparsed contents covers only bodies of the Raw type." The decision is made for all bodies that exceed the processable size (JSON, XML, form included).
How it is done in the documentation
