Hi Zhao,
Thank you for your reply. I now understand how [AlwaysAllowedUrls] works and where the query string check is still performed on the allowed Urls.
To clarify, here is what I would like to achieve. For instance, I would like the following 'url+query string' to be valid:
http://www.domain.com/search.aspx?keyword=declare(exec(...))
with proper escaping of course. I initially added the following to the urlscan.ini
[AlwaysAllowedUrls]
/search.aspx
but as you explained this should not and did not work. Looking at the documentation and from my experimentation, there is no way to introduce any wildcard in the [AlwaysAllowedQueryStrings] section which is what I would need here. Ideally, I would like to be able to define something like (if regex if possible):
[AlwaysAllowedQueryStrings]
keyword=.*
Is this possible? This would be very useful for implementing the Sql Injection custom rules.
Thank you,
Yves