CODEWITHSUNDEEP
spring-boot-actuatorgoogle-cloud-armor
michael.d
michael.d

Reputation: 11

Google Cloud Armor rule partial URL encoded

I added a new rule for deny all the external requests to 'actuator' .(spring endpoints) as following: enter image description here

The rule works as expected until I am using partial decode URL like:

<host>/%61ctuator

Do you know any way or a better to define a rule like that that block encoded URLs as well?

Upvotes: 1

Views: 776

Answers (1)

Dave
Dave

Reputation: 529

Cloud Armor recently released additional operator functionality that will allow for URL decoding of attributes within a given CEL rule match.

For example:

request.path.lower().urlDecode().contains("/actuator")

Upvotes: 1

Related Questions