HPE FlexNetwork HSR6800 series, Security Command Reference

Page: 425 / 538

412
Syntax
firewall http url-filter parameter { default | keywords keywords }
undo firewall http url-filter parameter [ default | keywords keywords ]
Views
System view
Default command level
2: System level
Parameters
default : Specifies to use the default parameter filtering entries, including: ^select$ , ^insert$ ,
^update$ , ^delete$ , ^drop$ , -- , ' , ^exec$ , and %27 .
keywords keywords : Specifies to use a user-defined parameter filtering entry. The keywords
argument is a case-insensitive string of 1 to 80 characters. Valid characters include numerals,
English letters, wildcards caret (^), dollar sign ($), ampersand (&), and asterisk (*), and other ASCII
characters with values in the range of 31 to 127. A filtering entry can be a string with spaces, but such
an entry must be present in quotes, for example, "
select all" . One space in a filtering entry can
match multiple consecutive spaces in a URL parameter of an HTTP request. For meanings of the
wildcards, see
Table 72 .
Table 72 Meanings of wildcards
Wildcard Meaning Usage guidelines
^
Matches parameters starting with
the keyword It can be present once at the
beginning of a filtering entry.
$
Matches parameters ending with
the keyword It can be present once at the end
of a filtering entry.
& Stands for one valid character
It can be present multiple times at
any position of a filtering entry,
consecutively or inconsecutively,
and cannot be used next to an
asterisk (*). If it is present at the
beginning or end of a filtering
entry, it must be next to a caret (^)
or a dollar sign ($).
*
Stands for up to 4 valid characters
including spaces It can be present once in the
middle of a filtering entry.
When using the wildcards, also follow the principles below:
•
A filtering entry with a caret (^) at the beginning or a dollar sign ($) at the end indicates an exact
match. For example, filtering entry
^webfilter$ matches website addresses containing
standalone webfilter , like www.abc.com/webfilter any . It does not match website addresses
like www.abc.com/webfilterany .
•
A filtering entry with neither a caret (^) at the beginning nor a dollar sign ($) at the end indicates
a fuzzy match, and matches website addresses containing the keyword.
Usage guidelines
If you do not specify any parameters, the undo firewall http url-filter parameter command will
remove all URL parameter filtering entries in the list.
The device supports a maximum of 256 URL parameter filtering entries, including the default ones.
You cannot specify the same URL filtering entries as the default ones in command firewall http
url-filter parameter keywords or undo firewall http url-filter parameter keywords .