Field types
A field type is a PCRE-format regular expression that defines a particular data format and minimum/maximum data lengths for a form field in a web form. Field types are used in the Field Formats check.
The Web App Firewall comes with several default field types, which are:
- integer. A string of any length consisting of numbers only, without a decimal point, and with an optional preceding minus sign (-).
- alpha. A string of any length consisting of letters only.
- alphanum. A string of any length consisting of letters and/or numbers.
- nohtml. A string of any length consisting of characters, including punctuation and spaces, that does not contain HTML symbols or queries.
- any. Anything at all.
Important:
Assigning the any field type as the default field type, or to a field, allows active scripts, SQL commands, and other possibly dangerous content to be sent to your protected web sites and applications in that form field. You should use the any type sparingly, if you use it at all.
You can also add your own field types to the Field Types list. For example, you might want to add a field type for a social security number, postal code, or phone number in your country. You might also want to add a field type for a customer identification number or store credit card number.
To add a field type to the Field Types list, you enter the field name as a literal string or PCRE-format regular expression.
To add a field type by using the command line interface
At the command prompt, type the following commands:
add appfw fieldType <name> <regex> <priority> [-comment "<string>"]save ns config
Example
The following example adds a field type named SSN that matches US Social Security numbers to the Field Types list, and sets its priority to 1.
add appfw fieldType SSN "^[1-9][0-9]{2,2}-[0-9}{2,2}-[0-9]{4,4}$" 1
save ns config
To modify a field type by using the command line interface
At the command prompt, type the following commands:
-
set appfw fieldType <name> <regex> <priority> [-comment "<string>"] -
save ns config
Example
The following example modifies the field type to add a comment.
set appfw fieldType SSN "^[1-9][0-9]{2,2}-[0-9}{2,2}-[0-9]{4,4}$" 1 -comment "US Social Security Number"
save ns config
To remove a field type by using the command line interface
At the command prompt, type the following commands:
>rm appfw fieldType <name>save ns config
To configure a field type by using the GUI
- Navigate to Security > Application Firewall.
- In the details pane, under Settings, click Manage Field Types.
- In the Manage Field Types dialog box, do one of the following:
- To add a new field type to the list, click Add.
- To change an existing field type, select the field type, and then click Edit.
The Configure Field Type dialog box appears.
Note:
If you select an existing field type designation and then click Add, the dialog box displays the information for that field type. You can modify that information to create your new field type.
- In the dialog box, fill out the elements. They are:
- Name
- Regular Expression
- Priority
- Comment
- Click Create or OK.
- To remove a field type from the Field Types list, select the field type listing you want to remove, then click Remove to remove it, and then click OK to confirm your choice.
- When you have finished adding, modifying, and removing field types, click Close.
Examples
Following are some regular expressions for field types that you might find useful:
`^[1-9][0-9]{2,2}-[0-9}{2,2}-[0-9]{4,4}$ U.S. Social Security numbers`
^\[A-C\]\[0-9\]{7,7}$ California driver's license numbers
^+[0-9]{1,3} [0-9() -]{1,40}$ International phone numbers with country codes
`^[0-9]{5,5}-[0-9]{4,4}$ U.S. ZIP code numbers`.
`^[0-9A-Za-z][0-9A-Za-z.+_-]{0,25}@([0-9A-Za-z][0-9A-Za-z_-]*[.]){1,4}[A-Za-z]{2,6}$ Email addresses``.