Smarter by Design.Simpler for Business
Query
What Is Query?
Query shows the inspections applied to the query (query string) section of the request. The tab consists of two layers: at the top the common rule applied to all the query parameters, at the bottom the variable table in which the argument rules specific to certain parameters are listed.
What Is a Query String?
The query is the section that comes after the ? mark in the request URL; it consists of the combination of the parameters in the name=value form with &. The inspections work on the raw (URL-encoded) text of the query (for example the length of the name a%20b counts as 5) and the parameter names are matched case sensitively. Every one of the inspections in this tab targets a certain element of the query:
An example request: /api/v1/login?user=john&otp=1234&lang=en-US
| Element | Its counterpart in the example | The related inspections |
|---|---|---|
| The parameter name (the key) | user, otp, lang | Query Key Length, Allowed / Required Query Parameters |
| The parameter value | john, 1234, en-US | Query Value Length, Query Value Pattern, OWASP Check |
| The number of parameters | 3 | Query Key Count |
| The whole of the query section | user=john&otp=1234&lang=en-US (29 characters) | Total Query Size |
| The repetition of the same parameter | In the ?id=100&id=200 request id occurs 2 times | Query Value Count |
Accessing the Screen
- The rule is clicked in the Page Types list; the detail panel of the rule opens on the right.
- The Query tab is clicked in the tab strip of the panel.
For the title elements of the panel and the behavior of the tab strip see Path. The value displays in the table also use the same form as in the Path tab: if there is no restriction No Restriction, the one-way restrictions ≤ n / ≥ n, the ranges [a - b], and the fields that are on/off are seen as ✓ / -.
The Detail Panel - The Query Tab
The inheritance and Rule Source
If the rule has not defined its own Query inspection, the values are inherited from the glob rule that matches the path or from the Any Paths rule according to the rule matching priority; the Rule Source row at the end of the table shows the path of the rule the inspections come from (for example Any Paths). In the example in the screenshot the values come from the default configuration of the Any Paths rule. If the rule defines its own Query inspection, the Rule Source row is not present.
The Add Common Rule for Query Screen
When the green plus icon Add common rule for Query button above the table is clicked, the form that defines the rule's own Query common inspection opens; with the save, the inheritance ends for that rule. If the rule already has its own Query inspection, the same button is seen as the pencil icon Edit common rule for Query (it opens the form with the current values) and Delete common rule for Query (it removes the common rule without asking a confirmation question). The add form does not open empty; it comes pre-filled with the related inspection values of the Any Paths rule. In the Any Paths rule itself, on the other hand, there is no delete button: the common inspection of the catch-all rule cannot be removed.
This screen is at the same time the edit screen: whether the common inspection has been added manually or has been formed by the learning, the form that opens with the Edit common rule for Query button shows the same fields below with the current values of the rule.
The Add Common Rule for Query Screen
INFO
Virtual Host Group
The host group to which the inspection will be added is shown as read-only; it is determined according to which group's Page Types screen the panel is opened from and cannot be changed from the form.
INFO
Path
The path of the rule to which the inspection will be added is shown; the form is bound to the rule for which the detail panel has been opened.
INFO
Area
It shows to which section of the request the inspection is applied. The field is locked to the tab the form is opened from: when the form is opened from the Query tab, it comes as Query and cannot be changed.
INFO
Argument Name
It shows the scope of the inspection. In the common rule form this field is locked as Any Arguments and the fields are applied to all the query parameters; a rule specific to a certain parameter, on the other hand, is defined from the Add Argument Rule for Query screen.
If a parameter has its own argument rule, the value inspections of that parameter (Query Value Length, Query Value Pattern, Query Value Count, OWASP Check, Detailed Log) are taken entirely from this rule; the value inspections of the common rule are no longer applied to that parameter. The section-wide inspections (Query Key Length, Query Key Count, Total Query Size, Allowed / Required Query Parameters), on the other hand, continue to be applied. Defining a rule specific to a name does not add that name to the Allowed Query Parameters list by itself.
INFO
Query Key Length
The length restriction of the name (the key) of a single query parameter is defined; the length is measured over the raw (URL-encoded) state of the name and in repeated parameters the name is evaluated once:
| Option | Meaning |
|---|---|
| No Restriction | No length restriction is applied. |
| Less Than or Equal To | The length must be equal to or below the entered value. |
| Equals To | The length must be equal to the entered value. |
| Greater Than or Equal To | The length must be equal to or above the entered value. |
| Range | The length must be between the two entered values (the limits included). |
Only a number can be entered in the value field. Every parameter name that does not comply with the restriction is scored as a Query Key Length violation in the Structure Limits category and falls into the attack record.
INFO
Query Key Count
The restriction of the number of query parameters in the request is defined. The counting is done over the different parameter names; the repetitions of the same name count as one (for example id=100&id=200 is a single parameter):
| Option | Meaning |
|---|---|
| No Restriction | No number restriction is applied. |
| Less Than or Equal To | The number of parameters must be equal to or below the entered value. |
| Equals To | The number of parameters must be equal to the entered value. |
| Greater Than or Equal To | The number of parameters must be equal to or above the entered value. |
| Range | The number of parameters must be between the two entered values (the limits included). |
Only a number can be entered in the value field. A request that does not comply with the restriction is scored as a Query Key Count violation in the Structure Limits category and falls into the attack record.
INFO
Total Query Size
The total size restriction of the query section is defined. The size is measured over the whole of the raw query text excluding the ? mark; the parameter names, the values, the & and = separators and the repeated parameters are included:
| Option | Meaning |
|---|---|
| No Restriction | No size restriction is applied. |
| Less Than or Equal To | The total size must be equal to or below the entered value. |
| Equals To | The total size must be equal to the entered value. |
| Greater Than or Equal To | The total size must be equal to or above the entered value. |
| Range | The total size must be between the two entered values (the limits included). |
Only a number can be entered in the value field. A request that does not comply with the restriction is scored as a Total Query Size violation in the Structure Limits category and falls into the attack record.
INFO
Allowed Query Parameters
The list of the allowed parameter names is defined (a positive list). While the field is in the No Restriction position, all the parameter names are allowed; when the restriction is turned on, the names are added to the list one by one. The matching is done exactly with the raw state of the parameter name and case sensitively; every different name that is not in the list is scored as an Allowed Query Parameters violation in the Structure Policies category and falls into the attack record. Defining an argument rule specific to a parameter does not add that name to this list by itself.
INFO
Required Query Parameters
The list of the parameter names that are required to be present in the request is defined. While the field is in the No Restriction position, no requirement is applied; when the restriction is turned on, every one of the names in the list that is missing is scored separately as a Required Query Parameters violation in the Structure Policies category. It is enough that the name be present in the request; its value may be empty. The requests that have no query section at all are also inspected and their required parameters count as missing.
INFO
Query Value Length
The length restriction of the parameter values is defined. The restriction is applied to every value of the parameter separately, over the raw (URL-encoded) length; in a multi-valued parameter only the values that exceed the restriction produce a violation:
| Option | Meaning |
|---|---|
| No Restriction | No length restriction is applied. |
| Less Than or Equal To | The value length must be equal to or below the entered value. |
| Equals To | The value length must be equal to the entered value. |
| Greater Than or Equal To | The value length must be equal to or above the entered value. |
| Range | The value length must be between the two entered values (the limits included). |
Only a number can be entered in the value field. Every value that exceeds the restriction is scored as a Query Value Length violation in the Structure Limits category and falls into the attack record.
INFO
OWASP Check Default: Checked
When it is checked, the name and every value of every parameter are subjected to the OWASP signature scanning separately; for Query it is checked by default. The content is scanned both in its raw state and in its state URL-decoded once; thus the attack patterns hidden by being encoded are also caught. The signature hits, differently from the structural violations, take part in the attack score by accumulating with their own scores. In the scanning, the signature set that is enabled on the OWASP Rules screen of the vService is used; for the listing of the signatures see Signature & Rule Library.
OWASP Exclusions
With this field that appears in the form when the box is checked, the OWASP rules to be excluded from the scanning are determined with a multiple selection; while the box is not checked, the field is not seen, and when no selection is made, Nothing chosen is written in the field. When an exclusion is defined, the number of the exclusions is shown next to the ✓ mark in the OWASP Check row in the detail panel.
INFO
Detailed Log Default: Checked
It manages the log detail of the signature (OWASP) hits; it is checked by default. While it is on, the matching content is shown together with its surrounding context in the Event Logs record; while it is off, the record still falls but instead of the content the phrase Detailed log disabled is seen. The summary information of the structural violations (for example the 2000>1024 comparison or the name of the violating parameter) is always written independently of this setting.
INFO
Query Value Pattern
The regular expression (regex) pattern the parameter values must match is defined. The inspection is positive: when the value does not match the pattern, a Query Value Pattern violation is produced in the Structure Policies category and the value itself is seen in the attack record. The pattern is searched anywhere in the value; if it is wanted that the whole of the value match, the pattern should be bounded with ^ and $. With the aA button next to the field the matching can be made case insensitive; this option is seen in the detail panel as the (-i) suffix next to the pattern. If no pattern is defined, no pattern inspection is applied to the value content.
INFO
Query Value Count
It is defined how many times at most the same parameter name can be repeated in a request; only an integer can be entered in the field. For example in the id=100&id=200 request id occurs twice; when the limit is exceeded, a Query Value Count violation is produced in the Structure Limits category. If it is left empty, no repetition restriction is applied; if 0 is entered, every use of the parameter counts as a violation.
INFO
Add
The common rule adding operation is completed by clicking the Add button; the button becomes enabled when no error remains in the form. There is no additional confirmation window or deployment (deploy) step; the WAF configuration is automatically produced again and applied and the values in the panel are updated instantly.
The mode behavior and the scoring
The structure inspections in this tab work only in the Blocking and Monitor modes; they are not run in the Learning mode, instead the restriction suggestions are learned from the observed traffic. The structural violations have a high score; at the default blocking threshold a single violation is enough for the request to be blocked in the Blocking mode (in the Monitor mode it is reported as an attack but the request is let through). The OWASP signature hits, on the other hand, reach the threshold by accumulating with their own scores.
The Add Argument Rule for Query Screen
The Argument table below the common rule lists the argument rules specific to certain query parameters; with the search box of the table a filtering can be done over the name. The argument rules the rule defines itself are shown in bold, the inherited ones in italic. When the green plus icon Add argument rule for Query button above the table is clicked, the form that defines an inspection specific to a single parameter opens.
When a row in the table is clicked, the detail of the argument rule opens below it; in the rule's own argument rule the pencil icon Edit (it opens the form with the current values) and trash can icon Delete (it removes the argument rule without asking a confirmation question) buttons are seen. In the inherited rows these buttons are not present; an inherited rule can be edited only from the rule that is its source.
In the rules specific to a path the add form does not open empty; the inspection fields come pre-filled with the common Query inspection values of the Any Paths rule. In the Any Paths rule itself, on the other hand, the form opens with the field defaults. This screen is at the same time the edit screen: the form that opens with the Edit button shows the same fields below with the current values of the rule; in the editing, differently from the add form, the Argument Name field is also locked; to which parameter the rule is bound cannot be changed afterwards.
The Add Argument Rule for Query Screen
INFO
Virtual Host Group
The host group to which the inspection will be added is shown as read-only; it is determined according to which group's Page Types screen the panel is opened from and cannot be changed from the form.
INFO
Path
The path of the rule to which the inspection will be added is shown; the form is bound to the rule for which the detail panel has been opened.
INFO
Area
It shows to which section of the request the inspection is applied. The field is locked to the tab the form is opened from: when the form is opened from the Query tab, it comes as Query and cannot be changed.
INFO
Argument Name
The name of the parameter to which the rule will be bound is defined. The scope selector is locked as One Argument in this form; the name is entered in the text box next to it and cannot be left empty (if it is left empty, the Enter argument name error is seen). The name is matched with the parameter name in the request exactly with its raw (URL-encoded) state and case sensitively; a name that contains a space must be entered in its encoded state such as a%20b.
A second argument rule with the same name cannot be added; on an attempt the part collision error is returned. In the edit form this field cannot be changed; if the rule is wanted to be moved to another parameter, it must be deleted and added again.
INFO
Query Value Length
The length restriction of the parameter values is defined. The restriction is applied to every value of the parameter separately, over the raw (URL-encoded) length; in a multi-valued parameter only the values that exceed the restriction produce a violation:
| Option | Meaning |
|---|---|
| No Restriction | No length restriction is applied. |
| Less Than or Equal To | The value length must be equal to or below the entered value. |
| Equals To | The value length must be equal to the entered value. |
| Greater Than or Equal To | The value length must be equal to or above the entered value. |
| Range | The value length must be between the two entered values (the limits included). |
Only a number can be entered in the value field. Every value that exceeds the restriction is scored as a Query Value Length violation in the Structure Limits category and falls into the attack record.
INFO
OWASP Check Default: Checked
When it is checked, the name and every value of the parameter are subjected to the OWASP signature scanning separately; it is checked by default. The content is scanned both in its raw state and in its state URL-decoded once; thus the attack patterns hidden by being encoded are also caught. When the box is removed, the parameter goes out of the signature scanning entirely together with its name and all its values; this is the way of exempting from the scanning a parameter that frequently produces false positives. In the scanning, the signature set that is enabled on the OWASP Rules screen of the vService is used; for the listing of the signatures see Signature & Rule Library.
OWASP Exclusions
With this field that appears in the form when the box is checked, the OWASP rules to be excluded from the scanning are determined with a multiple selection; while the box is not checked, the field is not seen, and when no selection is made, Nothing chosen is written in the field. The exclusions are applied only to the scanning of this parameter; the other parameters continue to use the exclusion list of the common rule.
INFO
Detailed Log Default: Checked
It manages the log detail of the signature (OWASP) hits; it is checked by default. While it is on, the matching content is shown together with its surrounding context in the Event Logs record; while it is off, the record still falls but instead of the content the phrase Detailed log disabled is seen. The summary information of the structural violations (for example the 2000>1024 comparison or the name of the violating parameter) is always written independently of this setting.
INFO
Query Value Pattern
The regular expression (regex) pattern the parameter values must match is defined. The inspection is positive: when the value does not match the pattern, a Query Value Pattern violation is produced in the Structure Policies category and the value itself is seen in the attack record. The pattern is searched anywhere in the value; if it is wanted that the whole of the value match, the pattern should be bounded with ^ and $. With the aA button next to the field the matching can be made case insensitive; this option is seen in the detail panel as the (-i) suffix next to the pattern. If no pattern is defined, no pattern inspection is applied to the value content.
INFO
Query Value Count
It is defined how many times at most the parameter name can be repeated in a request; only an integer can be entered in the field. For example in the id=100&id=200 request id occurs twice; when the limit is exceeded, a Query Value Count violation is produced in the Structure Limits category. If it is left empty, no repetition restriction is applied; if 0 is entered, every use of the parameter counts as a violation.
INFO
Add
The argument rule adding operation is completed by clicking the Add button; the button becomes enabled when no error remains in the form. There is no additional confirmation window or deployment (deploy) step; the WAF configuration is automatically produced again and applied and the values in the table are updated instantly.
An empty field does not mean inheriting from the common rule
When the argument rule is saved, the value inspections of the parameter are taken entirely from this rule; the value inspections of the common rule are no longer applied to that parameter. The pre-filling in the form is only a starting convenience: after the save the fields are independent of the common rule and a field left empty (for example Query Value Count) does not return to the value in the common rule, it means no restriction for that inspection. The section-wide inspections (Query Key Length, Query Key Count, Total Query Size, Allowed / Required Query Parameters), on the other hand, are not affected by the argument rule and continue to be applied.
The inheritance and the learning
The argument rules are also inherited according to the rule matching priority: if the rule has not defined its own argument rule for a parameter, the argument rule with the same name of the glob rule that matches the path or of the Any Paths rule becomes valid. The inherited rules are listed in italic in the table; in their detail the Rule Source row shows the path the rule comes from. When the rule defines its own argument rule for the same name, the inherited rule stays invalid for that rule.
The learning (Conditional Learning, AI Learning, Teacher and teaching over Event Logs) writes the updates to the argument rule if there is one specific to the parameter (for example it adds an exclusion to the OWASP Exclusions list or widens the limits); the rules added manually are also within this scope. The learning does not create a new argument rule by itself; if there is no rule specific to the parameter, the change is written to the common rule.
