Transformation Functions :: WGE

t:none

Mon, 01 Jan 0001 00:00:00 +0000

Description: Clears the transformation chain. t:none clears all transformation functions that appear before t:none in the transformation chain. After using t:none, only transformation functions explicitly specified after it will be applied. Syntax: t:none Implemented: Yes Example: # Assume default action includes t:lowercase,t:urlDecode SecDefaultAction "phase:2,log,pass,t:lowercase,t:urlDecode" # This rule inherits default transformations SecRule ARGS "@rx admin" "id:1,deny,msg:'admin detected'" # Use t:none to clear default transformations, apply only t:base64Decode SecRule ARGS:encoded "@rx admin" \ "id:2,t:none,t:base64Decode,deny,msg:'admin detected in Base64'" # Apply no transformations at all SecRule REQUEST_BODY "@rx ^\{" \ "id:3,t:none,pass,setvar:tx.is_json=1"

t:lowercase

Mon, 01 Jan 0001 00:00:00 +0000

Description: Converts uppercase characters to lowercase in a string. Syntax: t:lowercase Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:lowercase"

t:uppercase

Mon, 01 Jan 0001 00:00:00 +0000

Description: Converts lowercase characters to uppercase in a string. Syntax: t:uppercase Implemented: No WGE can parse this transformation function, but the functionality is not yet implemented.

t:urlDecode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Performs URL decoding on a string. This transformation function performs URL decoding on the input string. Invalid encodings will be skipped without affecting the decoding of the remaining valid encodings. Syntax: t:urlDecode Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:urlDecode"

t:urlDecodeUni

Mon, 01 Jan 0001 00:00:00 +0000

Description: Performs URL decoding on a string. This transformation function is similar to t:urlDecode, but adds support for Microsoft-specific %u encoding. If the code point is in the FF01-FF5E range (fullwidth ASCII), the high byte is used to detect and adjust the low byte. Otherwise, only the low byte is used and the high byte is zeroed. Syntax: t:urlDecodeUni Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:urlDecodeUni"

t:urlEncode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Performs URL encoding on a string. Syntax: t:urlEncode Implemented: No WGE can parse this transformation function, but the functionality is not yet implemented.

t:base64Decode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Decodes a Base64-encoded string. Syntax: t:base64Decode Implemented: Yes Example: # Detect Base64-encoded attack payloads SecRule ARGS:data "@rx (eval|exec|system)" \ "id:1,phase:2,t:base64Decode,deny,msg:'Base64-encoded code execution detected'" # Original input: ZXZhbChiYXNlNjRfZGVjb2RlKCR4KSk= # After decoding: eval(base64_decode($x))

t:base64DecodeExt

Mon, 01 Jan 0001 00:00:00 +0000

Description: Decodes a Base64-encoded string. Similar to t:base64Decode, but this transformation function uses a lenient implementation that ignores invalid characters. Syntax: t:base64DecodeExt Implemented: No WGE can parse this transformation function, but the functionality is not yet implemented.

t:base64Encode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Encodes a string using Base64. Syntax: t:base64Encode Implemented: No WGE can parse this transformation function, but the functionality is not yet implemented.

t:cmdline

Mon, 01 Jan 0001 00:00:00 +0000

Description: Normalizes a string as command line arguments. This transformation function processes the input string in the following ways: Remove all backslashes \ Remove all double quotes " Remove all single quotes ' Remove all carets ^ Remove spaces before slashes / Remove spaces before left parentheses ( Replace commas , and semicolons ; with spaces Compress consecutive whitespace (including tabs, newlines) into a single space Convert characters to lowercase Syntax: t:cmdline

t:hexDecode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Decodes a hexadecimal-encoded string. Syntax: t:hexDecode Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:hexDecode"

t:hexEncode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Encodes a string using hexadecimal encoding. Syntax: t:hexEncode Implemented: Yes Example: SecRule ARGS "@rx 74657374" "id:1001,t:hexEncode" # test encoded with hexEncode becomes 74657374

t:htmlEntityDecode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Decodes HTML entity escape sequences in a string. Syntax: t:htmlEntityDecode Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:htmlEntityDecode"

t:jsDecode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Decodes JavaScript escape sequences in a string. If the \uHHHH code point is in the FF01-FF5E range (fullwidth ASCII), the high byte is used to detect and adjust the low byte. Otherwise, only the low byte is used and the high byte is zeroed (which may result in information loss). Syntax: t:jsDecode Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:jsDecode"

t:cssDecode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Decodes CSS escape sequences in a string. Syntax: t:cssDecode Implemented: Yes Example: # Detect CSS injection attacks SecRule ARGS "@rx expression|javascript" \ "id:1,phase:2,t:cssDecode,t:lowercase,deny,msg:'CSS injection detected'" # Original input: \65\78\70\72\65\73\73\69\6f\6e (CSS-encoded "expression") # After decoding: expression

t:escapeSeqDecode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Decodes ANSI C escape sequences in a string back to their actual characters. This transformation function decodes ANSI C escape sequences: \a, \b, \f, \n, \r, \t, \v, \, ?, ', ", \xHH (hexadecimal), and \0OOO (octal). Invalid encodings are preserved in the output unchanged. Syntax: t:escapeSeqDecode Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:escapeSeqDecode"

t:sqlHexDecode

Mon, 01 Jan 0001 00:00:00 +0000

Description: Decodes SQL hexadecimal data in a string. Syntax: t:sqlHexDecode Implemented: No WGE can parse this transformation function, but the functionality is not yet implemented.

t:removeNulls

Mon, 01 Jan 0001 00:00:00 +0000

Description: Removes NULL characters from a string. This transformation function removes all NULL (0x00) characters from the input string. Syntax: t:removeNulls Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:removeNulls"

t:removeWhitespace

Mon, 01 Jan 0001 00:00:00 +0000

Description: Removes whitespace characters from a string. This transformation function removes all \x20\f\t\n\r\v\xA0 characters from the input string. Syntax: t:removeWhitespace Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:removeWhitespace"

t:compressWhitespace

Mon, 01 Jan 0001 00:00:00 +0000

Description: Compresses whitespace in a string, reducing consecutive spaces to a single space. This transformation function processes the input string in the following ways: Converts all whitespace characters (including 0x20, \f, \t, \n, \r, \v, 0xa0) to spaces Compresses consecutive spaces into a single space Syntax: t:compressWhitespace Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:compressWhitespace"

t:removeComments

Mon, 01 Jan 0001 00:00:00 +0000

Description: Removes comment blocks from a string. This transformation function removes the following comment blocks from the input string: /**/ -- # Syntax: t:removeComments Implemented: Yes Example: SecRule ARGS "@rx test" "id:1001,t:removeComments"

t:removeCommentsChar

Mon, 01 Jan 0001 00:00:00 +0000

Description: Removes comment characters from a string. This transformation function removes the following comment characters from the input string: -- # /* */