"<file-upload-restriction-rule_name>"

Enter the name of a new or existing rule. The maximum length is 63 characters.

To display the list of existing rules, enter:

edit ?

host-status {enable | disable}

Enable to apply this exception only to HTTP requests for specific web hosts.

Disable to match the exception based upon the other criteria, such as the URL, but regardless of the Host: field.

host "<protected-host_name>"

Enter the name of a protected host that the Host: field of an HTTP request must be in order to match the rule. The maximum length is 256 characters.

This setting applies only if host-status {enable | disable} is enable.

request-file "<url_pattern>"

Depending on your selection in request-type {regular | plain}, type either:

• The literal URL, such as /fileupload, that the HTTP request must contain in order to match the signature exception. The URL must begin with a slash ( / ).
• A regular expression, such as ^/*.php, matching all and only the URLs to which the signature exception should apply. The pattern is not required to begin with a slash ( / ). However, it must at least match URLs that begin with a slash, such as /index.cfm.

Do not include the name of the web host, such as www.example.com, which is configured separately in analyzer-policy "<fortianalyzer-policy_name>". The maximum length is 256 characters.

Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the FortiWeb Administration Guide:

https://docs.fortinet.com/fortiweb/admin-guides

request-type {regular | plain}

file-size-limit <size_int>

Optionally, enter a number to represent the maximum size in kilobytes for any individual file. This places a size limit on allowed file types.

The maximum acceptable values are:

102400 KB: FortiWeb 100D, 100E, 100F, 400C, 400D, 400E, 400F, 600D, 600E, 600F, 1000C, 3000CFsx, 4000C

204800 KB: FortiWeb 1000D, 2000D, 3000D, 3000DFsx, 4000D, 1000E, 2000E, 3010E, 1000F, 2000F

358400 KB: FortiWeb 3000E, 4000E, 3000F, 4000F

type {Allow| Block}

Select to Allow or Block file types and custom file types

octet-stream-filename-position {Default | Header |Parameter | Resource}

Identify where to retrieve the filename of 'application/octet-stream' type file.

octet-stream-filename-string <Header or Parameter names>

Specify the header or parameter names to get the file name of octet-stream. e.g. X-File-Name;X-Name.

json-file-support {enable | disable}

Enable JSON File Support if you want FortiWeb to further parse the file contained in JSON file.

json-key-for-filename <filename>

json-key-field <FileContents>

FortiWeb will parse the JSON file to find the value of the content parameter, and compare it against the value you set for json-key-field.

Both json-key-for-filename and json-key-field require exact match and are case sensitive.

If both of them matches, FortiWeb will apply File Security policy to the file contained in JSON file.

If only json-key-field matches, FortiWeb will apply File Security policy to the file contained in JSON file, and in the attack log the name of the file will be shown as "JSON File".

If only json-key-for-filename matches, it equals to no match. FortiWeb will not execute further scan to the file contained in JSON file.

enable_base64_decode {enable | disable}

Enable to decode the file contained in the JSON file with base64.

file-uncompress {enable | disable}

Enable file unzip in CLI to verify file type and size in the compressed files.

uncompress-nest-limit <int>

Type the maximum number of allowed levels of

compression (“nesting”) that FortiWeb will attempt to

decompress.

The valid range is 1-100.

uncompress-oversize-limit <int>

Type the maximum size in kilobytes (KB) of the memory buffer that FortiWeb will use to temporarily undo the compression.

When the file has multiple compression levels and the size of the decompressed files reaches the maximum when FortiWeb decompresses to a certain level, then FortiWeb will only check the already-decompressed files. The files that are not decompressed will pass through FortiWeb without scanning.

<entry_index>

file-type-id "<id_str>"

Select the numeric type ID that corresponds to the file type. Recognized IDs are updated by FortiGuard services and may vary. For a list of available IDs, select all file types in the GUI, then use the CLI to view their corresponding IDs. Common IDs include:

• 00001 (GIF)

• 00002 (JPG)

• 00003 (PDF)

• 00004 (XML)

• 00005 (MP3)

• 00006 (MIDI)

• 00007 (WAVE)

• 00008 (FLV for a Macromedia Flash Video)

• 00009 (RAR)

• 00010 (ZIP)

• 00011 (BMP)

• 00012 (RM for RealMedia)

• 00013 (MPEG for MPEG v)

• 00014 (3GPP)

• 00203 (MSI)

• 00204 (BAT)

file-type_name "<file-type-extension_str>"

Enter the extension, such as MP3, of the file type to allow to be uploaded. Recognized file types are updated by FortiGuard services and may vary. For a list of available names, use the GUI.

Note: Microsoft Office Open XML file types such as .docx, xlsx, .pptx, and .vsdx are a type of ZIP-compressed XML. If you specify restrictions for them, those signatures will take priority. However, if you do not select a MSOOX restriction but do have an XML or ZIP restriction, the XML and ZIP restrictions will still apply, and the files will still be restricted.