Rewrite rules converted to IIS 7.5

Question

Hi I have the following rules I want to import into IIS URL rewrite:

RewriteCond %{REQUEST_METHOD} GET
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC]
RewriteRule .* - [F]

However, when using the import, I get this error: This rule was not converted because only some of the conditions are using the OR flag.

Any ideas on how to do this in IIS?

IIS rewrite module can not do AND and OR for the same rule (when it is a group of conditions, it is either MatchAny or MatchAll). — cheesemacfly
Hi Cheesmacfly - I'm not sure if the case sensitive is important. This was a suggested htaccess rule to beef up a Joomla site security. from my testing it was the request_method GET line that caused the issue...Is there any way to nest rules/conditions? — cveile
Alternatively, could I break this into 3 separate rules and achieve the same result? so each rule would have the request method condition and then one of the query string conditions with the rule? If you can't tell, I'm a noob to htaccess/re-write — cveile
Just posted an answer. I ran some tests and it should work but let me know if it doesn't. — cheesemacfly

cheesemacfly cheesemacfly · Accepted Answer · 2013-08-08T18:09:36

As mentioned in my comment, the IIS rewrite module can not do AND and OR for the same rule (when it is a group of conditions, it is either MatchAny or MatchAll).

Here is how you could solve the issue:

<rule name="My rule" stopProcessing="true">
    <match url=".*" ignoreCase="false" />
    <conditions logicalGrouping="MatchAll">
        <add input="{REQUEST_METHOD}" pattern="GET" />
        <add input="{QUERY_STRING}" pattern="[a-zA-Z0-9_]=(http://)|(\.\.//?)+|(/([a-z0-9_.]//?)+)" />
    </conditions>
    <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
</rule>

It "combines" all the 3 rules you had in only one using the logical | (OR) operator: [a-zA-Z0-9_]=(http://)|(\.\.//?)+|(/([a-z0-9_.]//?)+).

Rewrite rules converted to IIS 7.5

1 Answers