Skip to content

Commit f76e6a9

Browse files
authored
[WAF] Update content scanning limit from 30 to 50 MB (#25817)
1 parent 6c7a586 commit f76e6a9

File tree

2 files changed

+5
-6
lines changed

2 files changed

+5
-6
lines changed

src/content/docs/waf/detections/malicious-uploads/example-rules.mdx

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,11 @@ This custom rule example blocks requests addressed at `/upload` with uploaded co
3636
- Expression: `any(cf.waf.content_scan.obj_sizes[*] > 512000) and http.request.uri.path eq "/upload"`
3737
- Action: _Block_
3838

39-
## Block requests with uploaded files over the content scanning limit (30 MB)
39+
## Block requests with uploaded files over the content scanning limit (50 MB)
4040

41-
This custom rule example blocks requests with uploaded content objects over 30 MB in size (the current content scanning limit):
41+
This custom rule example blocks requests with uploaded content objects over 50 MB in size (the current content scanning limit):
4242

43-
- Expression: `any(cf.waf.content_scan.obj_sizes[*] >= 31457280)`
43+
- Expression: `any(cf.waf.content_scan.obj_sizes[*] >= 52428800)`
4444
- Action: _Block_
4545

46-
In this example, you must also test for equality because currently any file over 30 MB will be handled internally as if it had a size of 30 MB (31,457,280 bytes). This means that using the `>` (greater than) [comparison operator](/ruleset-engine/rules-language/operators/#comparison-operators) would not work for this particular rule — you should use `>=` (greater than or equal) instead.
46+
In this example, you must also test for equality because currently any file over 50 MB will be handled internally as if it had a size of 50 MB (52,428,800 bytes). This means that using the `>` (greater than) [comparison operator](/ruleset-engine/rules-language/operators/#comparison-operators) would not work for this particular rule — you should use `>=` (greater than or equal) instead.

src/content/docs/waf/detections/malicious-uploads/index.mdx

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ sidebar:
99

1010
import { GlossaryTooltip, Type } from "~/components";
1111

12-
1312
The malicious uploads detection, also called uploaded content scanning, is a WAF [traffic detection](/waf/concepts/#detection-versus-mitigation) that scans content being uploaded to your application.
1413

1514
When enabled, content scanning attempts to detect content objects, such as uploaded files, and scans them for malicious signatures like malware. The scan results, along with additional metadata, are exposed as fields available in WAF [custom rules](/waf/custom-rules/), allowing you to implement fine-grained mitigation rules.
@@ -56,7 +55,7 @@ Content scanning can check the following content objects for malicious content:
5655

5756
All content objects in an incoming request will be checked, namely for requests with multiple uploaded files (for example, a submitted HTML form with several file inputs).
5857

59-
The content scanner will fully check content objects with a size up to 30 MB. For larger content objects, the scanner will analyze the first 30 MB and provide scan results based on that portion of the object.
58+
The content scanner will fully check content objects with a size up to 50 MB. For larger content objects, the scanner will analyze the first 50 MB and provide scan results based on that portion of the object.
6059

6160
:::note[Notes]
6261

0 commit comments

Comments
 (0)