Fortinet black logo

CLI Reference

waf file-upload-restriction-rule

waf file-upload-restriction-rule

Use this command to define the specific host and request URL for which file upload restrictions apply, and define the specific file types that can be uploaded to that host or URL.

To apply the rule, select it in a file security policy. For details, see waf file-upload-restriction-policy.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf file-upload-restriction-rule

edit "<file-upload-restriction-rule_name>"

set host-status {enable | disable}

set host "<protected-host_name>"

set request-file "<url_pattern>"

set request-type {regular | plain}

set file-size-limit <size_int>

set json-file-support {enable | disable}

set json-key-for-filename <filename>

set json-key-field <FileContents>

set waf file-upload-restriction-rule

set file-uncompress {enable | disable}

set uncompress-nest-limit <int>

set uncompress-oversize-limit <int>

config file-types

edit <entry_index>

set file-type-id "<id_str>"

set file-type_name "<file-type-extension_str>"

next

config file-types

edit <entry_index>

set file-extention <file-type-extension_str>

next

end

next

end

Variable Description Default

"<file-upload-restriction-rule_name>"

Enter the name of a new or existing rule. The maximum length is 63 characters.

To display the list of existing rules, enter:

edit ?

No default.

host-status {enable | disable}

Enable to apply this exception only to HTTP requests for specific web hosts.

Disable to match the exception based upon the other criteria, such as the URL, but regardless of the Host: field.

disable

host "<protected-host_name>"

Enter the name of a protected host that the Host: field of an HTTP request must be in order to match the rule. The maximum length is 256 characters.

This setting applies only if host-status {enable | disable} is enable.

No default.

request-file "<url_pattern>"

Depending on your selection in request-type {regular | plain}, type either:

  • The literal URL, such as /fileupload, that the HTTP request must contain in order to match the signature exception. The URL must begin with a slash ( / ).
  • A regular expression, such as ^/*.php, matching all and only the URLs to which the signature exception should apply. The pattern is not required to begin with a slash ( / ). However, it must at least match URLs that begin with a slash, such as /index.cfm.

Do not include the name of the web host, such as www.example.com, which is configured separately in analyzer-policy "<fortianalyzer-policy_name>". The maximum length is 256 characters.

Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the FortiWeb Administration Guide:

HTTPs://docs.fortinet.com/fortiweb/admin-guides

No default.

request-type {regular | plain}

Select whether analyzer-policy "<fortianalyzer-policy_name>" will contain a literal URL (plain), or a regular expression designed to match multiple URLs (regular). plain

file-size-limit <size_int>

Optionally, enter a number to represent the maximum size in kilobytes for any individual file. This places a size limit on allowed file types. The valid range is 0–30720 KB. 0

json-file-support {enable | disable}

Enable JSON File Support if you want FortiWeb to further parse the file contained in JSON file.

Disable

json-key-for-filename <filename>

  • FortiWeb will parse the JSON file to find the value of the filename parameter, and compare it against the value you set for json-key-for-filename. This is optional.
  • No default.

    json-key-field <FileContents>

    FortiWeb will parse the JSON file to find the value of the content parameter, and compare it against the value you set for json-key-field.

    Both json-key-for-filename and json-key-field require exact match and are case sensitive.

    If both of them matches, FortiWeb will apply File Security policy to the file contained in JSON file.

    If only json-key-field matches, FortiWeb will apply File Security policy to the file contained in JSON file, and in the attack log the name of the file will be shown as "JSON File".

    If only json-key-for-filename matches, it equals to no match. FortiWeb will not execute further scan to the file contained in JSON file.

    No default.

    enable_base64_decode {enable | disable}

    Enable to decode the file contained in the JSON file with base64.

    enable

    file-uncompress {enable | disable}

    Enable file unzip in CLI to verify file type and size in the compressed files.

    disable

    uncompress-nest-limit <int>

    Type the maximum number of allowed levels of

    compression (“nesting”) that FortiWeb will attempt to

    decompress.

    The valid range is 1-100.

    12

    uncompress-oversize-limit <int>

    Type the maximum size in kilobytes (KB) of the memory

    buffer that FortiWeb will use to temporarily undo the

    compression.

    When the file has multiple compression levels and the size of the decompressed files reaches the maximum when FortiWeb decompresses to a certain level, then FortiWeb will only check the already-decompressed files. The files that are not decompressed will pass through FortiWeb without scanning.

    The maximum acceptable values are:

    102400 KB: FortiWeb 100D, 100E, 400C, 400D, 400E, 600D, 600E, 1000C, 3000CFsx, 4000C

    204800 KB: FortiWeb 1000D, 2000D, 3000D, 3000DFsx, 4000D, 1000E, 2000E, 3010E, 2000F

    358400 KB: FortiWeb 3000E, 4000E, 3000F, 4000F

    5,000

    <entry_index>

    Enter the index number of the individual entry in the table. Each entry in the table can define one file type. The valid range is 1–9,999,999,999,999,999,999. No default.

    file-type-id "<id_str>"

    Select the numeric type ID that corresponds to the file type. Recognized IDs are updated by FortiGuard services and may vary. For a list of available IDs, select all file types in the GUI, then use the CLI to view their corresponding IDs. Common IDs include:

    • 00001 (GIF)

    • 00002 (JPG)

    • 00003 (PDF)

    • 00004 (XML)

    • 00005 (MP3)

    • 00006 (MIDI)

    • 00007 (WAVE)

    • 00008 (FLV for a Macromedia Flash Video)

    • 00009 (RAR)

    • 00010 (ZIP)

    • 00011 (BMP)

    • 00012 (RM for RealMedia)

    • 00013 (MPEG for MPEG v)

    • 00014 (3GPP)

    No default.

    file-type_name "<file-type-extension_str>"

    Enter the extension, such as MP3, of the file type to allow to be uploaded. Recognized file types are updated by FortiGuard services and may vary. For a list of available names, use the GUI.

    Note: Microsoft Office Open XML file types such as .docx, xlsx, .pptx, and .vsdx are a type of ZIP-compressed XML. If you specify restrictions for them, those signatures will take priority. However, if you do not select a MSOOX restriction but do have an XML or ZIP restriction, the XML and ZIP restrictions will still apply, and the files will still be restricted.

    No default.

    file-extention <file-type-extension_str>

    If the file type is not one of the Recognized file types, use this command to enter your custom file type.

    No default.

    Example

    This example allows both MPEG and FLV files uploaded to the URL /file-uploads on the host www.example.com.

    config waf file-upload-restriction-rule

    edit "file-upload-rule1"

    set host-status enable

    set host "www.example.com"

    set request-file "/file-uploads"

    config file-types

    edit 1

    set file-type-id "00013"

    set file-type-name "MPEG"

    next

    edit 2

    set file-type-id "00008"

    set file-type-name "FLV"

    next

    end

    next

    end

    Related topics

    waf file-upload-restriction-rule

    Use this command to define the specific host and request URL for which file upload restrictions apply, and define the specific file types that can be uploaded to that host or URL.

    To apply the rule, select it in a file security policy. For details, see waf file-upload-restriction-policy.

    To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

    Syntax

    config waf file-upload-restriction-rule

    edit "<file-upload-restriction-rule_name>"

    set host-status {enable | disable}

    set host "<protected-host_name>"

    set request-file "<url_pattern>"

    set request-type {regular | plain}

    set file-size-limit <size_int>

    set json-file-support {enable | disable}

    set json-key-for-filename <filename>

    set json-key-field <FileContents>

    set waf file-upload-restriction-rule

    set file-uncompress {enable | disable}

    set uncompress-nest-limit <int>

    set uncompress-oversize-limit <int>

    config file-types

    edit <entry_index>

    set file-type-id "<id_str>"

    set file-type_name "<file-type-extension_str>"

    next

    config file-types

    edit <entry_index>

    set file-extention <file-type-extension_str>

    next

    end

    next

    end

    Variable Description Default

    "<file-upload-restriction-rule_name>"

    Enter the name of a new or existing rule. The maximum length is 63 characters.

    To display the list of existing rules, enter:

    edit ?

    No default.

    host-status {enable | disable}

    Enable to apply this exception only to HTTP requests for specific web hosts.

    Disable to match the exception based upon the other criteria, such as the URL, but regardless of the Host: field.

    disable

    host "<protected-host_name>"

    Enter the name of a protected host that the Host: field of an HTTP request must be in order to match the rule. The maximum length is 256 characters.

    This setting applies only if host-status {enable | disable} is enable.

    No default.

    request-file "<url_pattern>"

    Depending on your selection in request-type {regular | plain}, type either:

    • The literal URL, such as /fileupload, that the HTTP request must contain in order to match the signature exception. The URL must begin with a slash ( / ).
    • A regular expression, such as ^/*.php, matching all and only the URLs to which the signature exception should apply. The pattern is not required to begin with a slash ( / ). However, it must at least match URLs that begin with a slash, such as /index.cfm.

    Do not include the name of the web host, such as www.example.com, which is configured separately in analyzer-policy "<fortianalyzer-policy_name>". The maximum length is 256 characters.

    Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the FortiWeb Administration Guide:

    HTTPs://docs.fortinet.com/fortiweb/admin-guides

    No default.

    request-type {regular | plain}

    Select whether analyzer-policy "<fortianalyzer-policy_name>" will contain a literal URL (plain), or a regular expression designed to match multiple URLs (regular). plain

    file-size-limit <size_int>

    Optionally, enter a number to represent the maximum size in kilobytes for any individual file. This places a size limit on allowed file types. The valid range is 0–30720 KB. 0

    json-file-support {enable | disable}

    Enable JSON File Support if you want FortiWeb to further parse the file contained in JSON file.

    Disable

    json-key-for-filename <filename>

  • FortiWeb will parse the JSON file to find the value of the filename parameter, and compare it against the value you set for json-key-for-filename. This is optional.
  • No default.

    json-key-field <FileContents>

    FortiWeb will parse the JSON file to find the value of the content parameter, and compare it against the value you set for json-key-field.

    Both json-key-for-filename and json-key-field require exact match and are case sensitive.

    If both of them matches, FortiWeb will apply File Security policy to the file contained in JSON file.

    If only json-key-field matches, FortiWeb will apply File Security policy to the file contained in JSON file, and in the attack log the name of the file will be shown as "JSON File".

    If only json-key-for-filename matches, it equals to no match. FortiWeb will not execute further scan to the file contained in JSON file.

    No default.

    enable_base64_decode {enable | disable}

    Enable to decode the file contained in the JSON file with base64.

    enable

    file-uncompress {enable | disable}

    Enable file unzip in CLI to verify file type and size in the compressed files.

    disable

    uncompress-nest-limit <int>

    Type the maximum number of allowed levels of

    compression (“nesting”) that FortiWeb will attempt to

    decompress.

    The valid range is 1-100.

    12

    uncompress-oversize-limit <int>

    Type the maximum size in kilobytes (KB) of the memory

    buffer that FortiWeb will use to temporarily undo the

    compression.

    When the file has multiple compression levels and the size of the decompressed files reaches the maximum when FortiWeb decompresses to a certain level, then FortiWeb will only check the already-decompressed files. The files that are not decompressed will pass through FortiWeb without scanning.

    The maximum acceptable values are:

    102400 KB: FortiWeb 100D, 100E, 400C, 400D, 400E, 600D, 600E, 1000C, 3000CFsx, 4000C

    204800 KB: FortiWeb 1000D, 2000D, 3000D, 3000DFsx, 4000D, 1000E, 2000E, 3010E, 2000F

    358400 KB: FortiWeb 3000E, 4000E, 3000F, 4000F

    5,000

    <entry_index>

    Enter the index number of the individual entry in the table. Each entry in the table can define one file type. The valid range is 1–9,999,999,999,999,999,999. No default.

    file-type-id "<id_str>"

    Select the numeric type ID that corresponds to the file type. Recognized IDs are updated by FortiGuard services and may vary. For a list of available IDs, select all file types in the GUI, then use the CLI to view their corresponding IDs. Common IDs include:

    • 00001 (GIF)

    • 00002 (JPG)

    • 00003 (PDF)

    • 00004 (XML)

    • 00005 (MP3)

    • 00006 (MIDI)

    • 00007 (WAVE)

    • 00008 (FLV for a Macromedia Flash Video)

    • 00009 (RAR)

    • 00010 (ZIP)

    • 00011 (BMP)

    • 00012 (RM for RealMedia)

    • 00013 (MPEG for MPEG v)

    • 00014 (3GPP)

    No default.

    file-type_name "<file-type-extension_str>"

    Enter the extension, such as MP3, of the file type to allow to be uploaded. Recognized file types are updated by FortiGuard services and may vary. For a list of available names, use the GUI.

    Note: Microsoft Office Open XML file types such as .docx, xlsx, .pptx, and .vsdx are a type of ZIP-compressed XML. If you specify restrictions for them, those signatures will take priority. However, if you do not select a MSOOX restriction but do have an XML or ZIP restriction, the XML and ZIP restrictions will still apply, and the files will still be restricted.

    No default.

    file-extention <file-type-extension_str>

    If the file type is not one of the Recognized file types, use this command to enter your custom file type.

    No default.

    Example

    This example allows both MPEG and FLV files uploaded to the URL /file-uploads on the host www.example.com.

    config waf file-upload-restriction-rule

    edit "file-upload-rule1"

    set host-status enable

    set host "www.example.com"

    set request-file "/file-uploads"

    config file-types

    edit 1

    set file-type-id "00013"

    set file-type-name "MPEG"

    next

    edit 2

    set file-type-id "00008"

    set file-type-name "FLV"

    next

    end

    next

    end

    Related topics