config security waf hidden-field-rule

Use this command to define the Hidden Field rule for Input Validation to check for hidden parameters from <input type="hidden"> HTML tags. These hidden parameters are often written into an HTML page by the web server when it serves that page to the client, and is not visible on the rendered web page.

The Hidden Field rule function can do the following:

• Check the HOST by simple string or regular expression matching.
• Check the URL by simple string or regular expression matching.
• Match the configuration of the fetched URL.

If the conditions are successfully matched, it will execute the specified action.

Syntax

config security waf hidden-field-rule
  edit <name>
    set host status {enable|disable}
    set host <string>
    set request-url <regex>
    set action <datasource>
    set severity {high|medium|low}
    config post-url-table
      edit <no.>
        set url <regex>
      next
    end
    config hidden-field-table
      edit <no.>
        set name <string>
      next
    end
  next
end

host-status	Enable to require that the Host: field of the HTTP request match a protected host name's entry in order to match the URL access rule. Also configure Host.
host	The host option is available if host-status is enabled. Select which protected host name's entry (either a web host name or IP address) that the Host: field of the HTTP request must be in to match the URL access rule.
request-url	The HTTP request URL must be start with /. eg./login. This item must be set when configuring the rule. FortiADC will match the other item (rule) when matching the request URL; if the match fails, FortiADC will not attempt to match others.
action	Select the action profile that you want to apply.
severity	When FortiADC records violations of this rule in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiADC uses when using Input Validation: low medium high The default value is low.
config post-url-table
url	Specify the Post URL on which the hidden fields function can work.
config hidden-field-table
name	Enter a unique Hidden Fields name. It must match the value of the name in the input type of the HTML request.

Example

config security waf hidden-field-rule
  edit "hidden_policy"
    set host-status enable
    set host 118.TEST.com
    set request-url /test/product.html
    set action deny
    config post-url-table
      edit 1
        set url /test/price.jsp
      next
    end
    config hidden-field-table
      edit 1
        set name price
      next
    end
  next
end