Skip to content

[BUG] Microsoft.Network/WebApplicationFirewallManagement - the computedDisabledRules.rules field has the wrong type #38407

@sreallymatt

Description

@sreallymatt

API Spec link

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/network/resource-manager/Microsoft.Network/stable/2025-01-01/webapplicationfirewall.json#L811-L817

API Spec version

2025-01-01

Describe the bug

computedDisabledRules.rules returns integers instead of strings.

2025-01-01/webapplicationfirewall.json#L811-L817

2025-01-01/webapplicationfirewall.json#L885-L890

While I initially observed this issue in 2025-01-01, it's also present in 2024-10-01 and 2024-07-01.

Expected behavior

API returns strings, or API spec is updated to reflect that the API returns integers

Actual behavior

API returns integers, instead of strings.

This is causing issues in our SDK generated from the API spec, since it fails to unmarshal the response due to the incorrect type.

Reproduction Steps

Create a web application firewall policy with disabled rules

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/{policyName}?api-version=2025-01-01

{
	"location": "westeurope",
	"properties": {
		"managedRules": {
			"exclusions": [],
			"managedRuleSets": [{
				"ruleGroupOverrides": [{
					"ruleGroupName": "REQUEST-920-PROTOCOL-ENFORCEMENT",
					"rules": [{
						"ruleId": "920440",
						"state": "Disabled"
					}]
				}],
				"ruleSetType": "OWASP",
				"ruleSetVersion": "3.2"
			}]
		},
		"policySettings": {
			"fileUploadEnforcement": false,
			"fileUploadLimitInMb": 100,
			"jsChallengeCookieExpirationInMins": 30,
			"maxRequestBodySizeInKb": 128,
			"mode": "Prevention",
			"requestBodyCheck": true,
			"requestBodyEnforcement": true,
			"requestBodyInspectLimitInKB": 128,
			"state": "Enabled"
		}
	}
}

Observe the response contains computedDisabledRules.rules as an array of integers

{
	"name": "{policyName}",
	...
	"properties": {
		"provisioningState": "Updating",
		"customRules": [],
		"policySettings": {
			"requestBodyCheck": true,
			"maxRequestBodySizeInKb": 128,
			"fileUploadLimitInMb": 100,
			"state": "Enabled",
			"mode": "Prevention",
			"jsChallengeCookieExpirationInMins": 30,
			"requestBodyInspectLimitInKB": 128,
			"fileUploadEnforcement": false,
			"requestBodyEnforcement": true
		},
		"managedRules": {
			"managedRuleSets": [{
				"ruleSetType": "OWASP",
				"ruleSetVersion": "3.2",
				"ruleGroupOverrides": [{
					"ruleGroupName": "REQUEST-920-PROTOCOL-ENFORCEMENT",
					"rules": [{
						"ruleId": "920440",
						"state": "Disabled"
					}]
				}],
				"computedDisabledRules": [{
					"ruleGroupName": "REQUEST-920-PROTOCOL-ENFORCEMENT",
					"rules": [920440]
				}]
			}],
			"exclusions": []
		}
	}
}

Environment

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugThis issue requires a change to an existing behavior in the product in order to be resolved.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions