On this page

Atomicorp WAF Rule 300079

Rule Summary

  • Rule ID: 300079
  • Status: Active
  • Alert message: Atomicorp.com WAF AntiSpam Rules: Possible Spam: Multiple embedded urls in argument (Disable if you wish to allow 4 or more URLs in a post)
  • Observed CWEs: None documented
  • Revision: 18
  • Rule severity: Warning (4)
  • Phase: 2 (request body)
  • Request surfaces: Request arguments, JSON request data, SOAP request data
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule detects the use of four or more URLs in a single post. This rule is part of the anti spam rule family, and is a simple method of detecting possible URL spamming.

If you wish to allow this, then disable this rule.

False Positives

The rule is very simple, and only detects four or more urls, it does not make any determination if these are spam urls or non-malicious urls. If you wish to allow the posting of four or more URLs, please disable this rule.

If this has occurred for an administrator only function, please report this as a false positive.

Tuning Guidance

If you know that this behavior is acceptable for your application, please see the Tuning the Atomicorp WAF Rules page for basic information.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 300079
  • Source revision: 1764
  • Source revision date: 2011-07-26