Example rules

​​ Log requests with an uploaded content object

This custom rule example logs all requests with at least one uploaded content object:

• Expression: cf.waf.content_scan.has_obj
• Action: Log

​​ Block requests to URI path with a malicious content object

This custom rule example blocks requests addressed at /upload.php that contain at least one uploaded content object considered malicious:

• Expression: cf.waf.content_scan.has_malicious_obj and http.request.uri.path eq "/upload.php"
• Action: Block

​​ Block requests with non-PDF file uploads

This custom rule example blocks requests addressed at /upload with uploaded content objects that are not PDF files:

• Expression: any(cf.waf.content_scan.obj_types[*] != "application/pdf") and http.request.uri.path eq "/upload"
• Action: Block

​​ Block requests with uploaded files over 500 KB

This custom rule example blocks requests addressed at /upload with uploaded content objects over 500 KB in size:

• Expression: any(cf.waf.content_scan.obj_sizes[*] > 500000) and http.request.uri.path eq "/upload"
• Action: Block