Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Which regex syntax is supported in custom rules (backreference, lookaround); can I test a rule before saving it?
Short answer
Custom rule patterns are compiled in the TR7 signature engine; the syntax is a subset of PCRE (Pattern (Regex)). Character classes, quantifiers, groups, alternations and anchors such as ^, $, \b can be used. Backreferences (\1, \k<name>, \g{…}, (?P=name)), lookahead and lookbehind ((?=…), (?!…), (?<=…), (?<!…)), the atomic group (?>…), the possessive quantifier (e.g. a*+), the conditional group (?(…)…), recursion and subroutine calls ((?R), (?1), (?&name)) and the \K, \G and \C escapes are not supported. The pattern is compiled case-sensitively, can be at most 4,096 characters long, and a pattern that can match the empty string (e.g. a*) is not compiled. Yes, it can be tested without saving: the Pattern (Regex) field in the Add Custom Rule and Edit Custom Rule windows compiles the pattern in the signature engine on the device while it is being typed and shows the result; the trial icon to the right of the field shows the match on sample inputs. A pattern that is not compiled cannot be saved with Accept.
Syntax
| Construct | Support |
|---|---|
Character classes, quantifiers (*, +, ?, {m,n}), groups ((…), (?:…)), alternations, ^ $ \b | Yes |
Backreference \1, \k<name>, \g{…}, (?P=name) | No |
Lookahead (?=…) (?!…), lookbehind (?<=…) (?<!…) | No |
Atomic group (?>…), possessive quantifier a*+, conditional group (?(…)…) | No |
Recursion / subroutine (?R), (?1), (?&name); \K, \G, \C | No |
| Case insensitivity | No option in the form; the variants are written with a character set (e.g. [Ss]elect) |
| Length | At most 4,096 characters |
Pattern that can match the empty string (e.g. a*) | Not compiled |
Large repetition limit (e.g. {1,1000}) | Compiled; at a limit of 256 and above, an information note appears stating that the compiled signature may grow |
When an unsupported construct is written, the The signature engine does not support this construct: … message appears below the field. A condition that requires lookaround is usually met by splitting the pattern or by narrowing the scope; e.g. for a pattern that is to be searched for only in the query parameter, only Query is selected in the Inspection Scopes list.
Testing Without Saving
1
Adım 1 Write the pattern
The pattern is written in the Pattern (Regex) field in the Add Custom Rule or Edit Custom Rule window. Syntax errors such as an unclosed group or no item to repeat appear below the field instantly, and the compilation result of the engine after a short wait: on success, Compiled by the signature engine and the size of the compiled signature (in the warning color from 2 MiB and in the danger color from 16 MiB), on failure, the error text of the engine. The WAF badge to the right of the field states that the pattern will work in the signature engine.
2
Adım 2 Open the trial area
The trial (flask) icon to the right of the field is clicked; a sample input box opens below it.
3
Adım 3 Write the sample inputs
A sample is written in the Sample input… box; a new sample is added with + on the last line. For each sample, Matches this input (with the matching part highlighted) or No match appears. E.g. the ^/legacy-admin(/|$) pattern matches for /legacy-admin/users and does not match for /Legacy-Admin.
4
Adım 4 Save
Accept is clicked; while there is an unresolved error in the form, the button is disabled. The device compiles the pattern again during saving; if it cannot be compiled, the Invalid WAF pattern error appears and the window stays open.
- If many trials are made at very short intervals, the engine slows down the requests for a while (Too many requests in a row …); a few seconds are allowed to pass.
- The same engine is also used in the value pattern fields of the page types; there, case-insensitive matching can be selected with the aA button. Value patterns are validated with the settings the WAF uses when compiling them for the traffic. For this reason, an anchored pattern that can also match an empty value, such as
^[a-z]*$, is accepted in a value pattern, but is not compiled in a custom rule pattern. Backreferences and lookaround are not supported in value patterns either (Can I restrict a parameter's value by length or regex pattern (Value length / Value pattern)?).
Common Misconceptions
- "A pattern that works in the browser or in another regex tool also works here." Patterns that contain lookaround and backreferences are not compiled in the signature engine.
- "A case-insensitivity option is added to the custom rule." There is no such option in the custom rule form; the uppercase and lowercase variants are written in the pattern with a character set.
- "Matching in the trial area is enough." The rule is scanned only in the sections that are in the Inspection Scopes list and have OWASP Check on; the trial does not include these conditions.
How it is done in the documentation
