Skip to content

[WAF] Update malicious uploads example #21360

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 3, 2025
Merged

[WAF] Update malicious uploads example #21360

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/content/docs/waf/detections/malicious-uploads/example-rules.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,10 @@ This custom rule example blocks requests addressed at `/upload` with uploaded co

This custom rule example blocks requests with uploaded content objects over 15 MB in size (the current content scanning limit):

- Expression: `any(cf.waf.content_scan.obj_sizes[*] >= 15000000)`
- Expression: `any(cf.waf.content_scan.obj_sizes[*] >= 15728640)`
- Action: _Block_

In this example, you must also test for equality because currently any file over 15 MB will be handled internally as if it had a size of 15 MB. This means that using the `>` (greater than) [comparison operator](/ruleset-engine/rules-language/operators/#comparison-operators) would not work for this particular rule — you should use `>=` (greater than or equal) instead.
In this example, you must also test for equality because currently any file over 15 MB will be handled internally as if it had a size of 15 MB (15,728,640 bytes). This means that using the `>` (greater than) [comparison operator](/ruleset-engine/rules-language/operators/#comparison-operators) would not work for this particular rule — you should use `>=` (greater than or equal) instead.

---

Expand Down