waf file-upload-restriction-rule

Use this command to define the specific host and request URL for which file upload restrictions apply, and define the specific file types that can be uploaded to that host or URL.

To apply the rule, select it in a file security policy. For details, see waf file-upload-restriction-policy.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf file-upload-restriction-rule

edit "<file-upload-restriction-rule_name>"

set host-status {enable | disable}

set host "<protected-host_name>"

set request-file "<url_pattern>"

set request-type {regular | plain}

set file-size-limit <size_int>

set json-file-support {enable | disable}

set json-key-for-filename <filename>

set json-key-field <FileContents>

set waf file-upload-restriction-rule

set file-uncompress {enable | disable}

config file-types

edit <entry_index>

set file-type-id "<id_str>"

set file-type_name "<file-type-extension_str>"

end

Variable	Description	Default
"<file-upload-restriction-rule_name>"	Enter the name of a new or existing rule. The maximum length is 63 characters. To display the list of existing rules, enter: `edit ?`	No default.
host-status {enable \| disable}	Enable to apply this exception only to HTTP requests for specific web hosts. Disable to match the exception based upon the other criteria, such as the URL, but regardless of the `Host:` field.	`disable`
host "<protected-host_name>"	Enter the name of a protected host that the `Host:` field of an HTTP request must be in order to match the rule. The maximum length is 256 characters. This setting applies only if host-status {enable \| disable} is `enable`.	No default.
request-file "<url_pattern>"	Depending on your selection in request-type {regular \| plain}, type either: The literal URL, such as `/fileupload`, that the HTTP request must contain in order to match the signature exception. The URL must begin with a slash ( / ). A regular expression, such as `^/.php`, matching all and only the URLs to which the signature exception should apply. The pattern is not* required to begin with a slash ( / ). However, it must at least match URLs that begin with a slash, such as `/index.cfm`. Do not include the name of the web host, such as `www.example.com`, which is configured separately in analyzer-policy "<fortianalyzer-policy_name>". The maximum length is 256 characters. Note: Regular expressions beginning with an exclamation point ( `!` ) are not supported. For information on language and regular expression matching, see the FortiWeb Administration Guide: https://docs.fortinet.com/fortiweb/admin-guides	No default.
request-type {regular \| plain}	Select whether analyzer-policy "<fortianalyzer-policy_name>" will contain a literal URL (`plain`), or a regular expression designed to match multiple URLs (`regular`).	plain
file-size-limit <size_int>	Optionally, enter a number to represent the maximum size in kilobytes for any individual file. This places a size limit on allowed file types. The valid range is 0–30720 KB.	0
json-file-support {enable \| disable}	Enable JSON File Support if you want FortiWeb to further parse the file contained in JSON file.	`Disable`
json-key-for-filename <filename>	FortiWeb will parse the JSON file to find the value of the `filename` parameter, and compare it against the value you set for json-key-for-filename. This is optional.	No default.
json-key-field <FileContents>	FortiWeb will parse the JSON file to find the value of the `content` parameter, and compare it against the value you set for json-key-field. Both json-key-for-filename and json-key-field require exact match and are case sensitive. If both of them matches, FortiWeb will apply File Security policy to the file contained in JSON file. If only json-key-field matches, FortiWeb will apply File Security policy to the file contained in JSON file, and in the attack log the name of the file will be shown as "JSON File". If only json-key-for-filename matches, it equals to no match. FortiWeb will not execute further scan to the file contained in JSON file.	No default.
enable_base64_decode {enable \| disable}	Enable to decode the file contained in the JSON file with base64.	`enable`
file-uncompress {enable \| disable}	Enable file unzip in CLI to verify file type and size in the compressed files.	`disable`
<entry_index>	Enter the index number of the individual entry in the table. Each entry in the table can define one file type. The valid range is 1–9,999,999,999,999,999,999.	No default.
file-type-id "<id_str>"	Select the numeric type ID that corresponds to the file type. Recognized IDs are updated by FortiGuard services and may vary. For a list of available IDs, select all file types in the GUI, then use the CLI to view their corresponding IDs. Common IDs include: 00001 (GIF) 00002 (JPG) 00003 (PDF) 00004 (XML) 00005 (MP3) 00006 (MIDI) 00007 (WAVE) 00008 (FLV for a Macromedia Flash Video) 00009 (RAR) 00010 (ZIP) 00011 (BMP) 00012 (RM for RealMedia) 00013 (MPEG for MPEG v) 00014 (3GPP)	No default.
file-type_name "<file-type-extension_str>"	Enter the extension, such as `MP3`, of the file type to allow to be uploaded. Recognized file types are updated by FortiGuard services and may vary. For a list of available names, use the GUI. Note: Microsoft Office Open XML file types such as .docx, xlsx, .pptx, and .vsdx are a type of ZIP-compressed XML. If you specify restrictions for them, those signatures will take priority. However, if you do not select a MSOOX restriction but do have an XML or ZIP restriction, the XML and ZIP restrictions will still apply, and the files will still be restricted.	No default.

Example

This example allows both MPEG and FLV files uploaded to the URL /file-uploads on the host www.example.com.

config waf file-upload-restriction-rule

edit "file-upload-rule1"

set host-status enable

set host "www.example.com"

set request-file "/file-uploads"

config file-types

edit 1

set file-type-id "00013"

set file-type-name "MPEG"

edit 2

set file-type-id "00008"

set file-type-name "FLV"

end