Is form data scanned both raw and URL-decoded?

Short answer

In URL-encoded form bodies (application/x-www-form-urlencoded), yes: every field name and every value goes through signature scanning first in its raw form, then in its once URL-decoded form (+ to a space, %xx to a character); if the same signature matches in both forms, it is counted once (Form · OWASP Check). Query parameters are also scanned with the same rule. Multipart form fields, headers, JSON and XML values are scanned only in their raw form. The body is first split on & and =, then the values are decoded; this way, an & encoded as %26 cannot produce a fake field. Structural inspections (value length, value pattern, allowed name lists) work on the undecoded raw text. The decoding of the path, on the other hand, is managed in the Checks window with the URL Decoding setting.

How Does It Work?

Section	Signature scanning	Structural inspections
Query	Raw + once decoded	Raw
Form (application/x-www-form-urlencoded)	Raw + once decoded	Raw
Form (multipart/form-data)	Raw	Raw
Header	Raw	Raw
JSON, Xml	Raw (parsed JSON/XML values)	Raw
Path	With URL Decoding off, raw + once decoded; with it on, the once decoded form (What does the URL Decoding setting affect; are query and form values decoded too?)	With URL Decoding on, the decoded path; with it off, the raw path

• Decoding is a single step: a double-encoded value (%2527) becomes %27 in one step; the second layer is not opened.
• The value length is measured on the raw text: the value a%20b is counted as 5 bytes. Parameter names are also compared in their raw form in the request.
• The scans are done while the OWASP Check setting of the related tab is on; if there is an argument rule specific to the parameter, its setting is valid.

In TR7

The decoding behavior is fixed; there is no separate setting for Query and Form. URL Decoding affects only the path and is changed in Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Inspection & Blocking section, from the window opened with the pencil icon of the Checks card. The sections in which signatures are scanned: In which parts of a request are signatures scanned (Path, Query, Header, JSON, XML, Form and Raw)?

Common Misconceptions

• "The form body is first decoded, then split." It is first split, then every name and value is decoded separately; an encoded & (%26) does not create a new field.
• "The URL decoding setting also affects query and form values." The setting is only for the path; query and form values are scanned in their raw and once decoded forms in every case.
• "Multipart fields are also scanned decoded." Multipart fields are scanned in their raw form; file contents are additionally scanned with the Raw settings (Is the content of uploaded files scanned as well (OWASP Check in Upload)?).

How it is done in the documentation

• Form · OWASP Check
• Query · OWASP Check
• Checks · URL Decoding

Related questions

• What does the URL Decoding setting affect; are query and form values decoded too?
• In which parts of a request are signatures scanned (Path, Query, Header, JSON, XML, Form and Raw)?
• In multipart requests, is the whole body scanned separately as well?