Cannot get URL filter to work (I really tried in all possible ways)

[fredrik-nti-johanneberg]

I'm trying to get URL filtering to work on Ciscos platform skillsforall.com given the following:

Start URL (this is the exam page): https://skillsforall.com/launch?id=437dd255-f560-43e4-aa3c-34185fc916da&tab=learning&assignment=e58d98dd-9870-4b8e-88d3-b04738a708a2&activeTab=assignmentdetails

I have an allow filter for https://auth.netacad.com/* which is necessary for authentication before opening the exam (the start URL will redirect to auth.netacad.com before opening). This filter works as expected.

There are links accessible on the exam page which navigates to pages with learning material that I want to restrict access to during the test. The learning material (course modules/chapters) have links that look like this: https://skillsforall.com/launch?id=437dd255-f560-43e4-aa3c-34185fc916da&tab=curriculum&view=6e73cc94-0b45-533d-8449-3c3bbcd8f215. There is an URL parameter tab=curriculum that I tried to use as a pattern for blocking these URLs.

So far I have tried blocking https://skillsforall.com/launch?id=437dd255-f560-43e4-aa3c-34185fc916da&tab=curriculum* (with and without the appended wildcard). I have also tried blocking these URLs with a regex rule: (?<==)curriculum(?=&) or a regular wildcard-rule *curriculum.

None of these blocking rules works. I'm unable to block this content. Maybe I'm missing something here, but I really tried to read through the documentation and similar topics posted here. The documentation mentions that "URL parameters like a query string can be indicated and always have to start with the character '?'. Parts of the query can be replaced with the wildcard char '*'.". However, there are no examples using the ?-sign and I do not fully understand if this is a valid token similar to wildcard.

Any help on this topic would be highly appreciated.

[fredrik-nti-johanneberg]

Some fruitless attempts later I suspect that blocking only seems to work when a full page reload is performed. Even when filtering embedded content I'm unable to block content accessible by clicking navigation elements in the exam page header. Clicking the "Content" button will only do a partial reload of the page. When I click the SEB-browser reload button I get a message saying that the URL is blocked (although still visible).

[dbuechel]

You can inspect the inner workings of the filtering mechanism in real time by activating the application log in your configuration (see https://safeexambrowser.org/windows/win_usermanual_en.html#SecurityPane > Allow access to application log et al.). Once enabled, open the application log via the action center or taskbar and then inspect which URLs are being blocked while navigation or performing actions in the browser.

[fredrik-nti-johanneberg]

I appreciate your response, although it didn't bring me further. Not whitelisted URLS/domains gets blocked allright, but my blacklist is not working. Could it be that blocking rules gets messed up when the particular URL resides on page with an allowed base URL (same domain + path/endpoint)? In my case only the query string makes it possible to distinguish them. I tried to set blocking rules by query string only, regex on full URL (unsure if the format is correct) and also on full URL (ending with wildcard - not visible in below screenshot). Or is it simply as stated above that it takes a full page reload for blocking rules to apply?

[dbuechel]

The second rule appears to lack a leading * or then the full host and path (e.g. https://skillsforall.com/launch?id=...). With respect to regex, there is an excellent online tool where you can test your expression and possible matches in real time: https://regex101.com/.

The request filtering first processes all blacklist rules and if one matches for a given URL, then the request is blocked. After that, the whitelist rules are processed and if one matches, then the request is allowed. Finally the default action is applied, which currently is blocking a request.

If you'd like to provide the rules as plain text, then I could debug and/or run them through the unit test suite for the filtering mechanism. If you are familiar with C#, the unit tests themselves might help you understand the filtering mechanism better, particularly with respect to the query part of an URL: https://github.com/SafeExamBrowser/seb-win-refactoring/blob/master/SafeExamBrowser.Browser.UnitTests/Filters/Rules/SimplifiedRuleTests.cs#L707.

[fredrik-nti-johanneberg]

Thanks for the details regarding how rules are applied. I did evaluate my regex with regex101.com (and a second online tool to be certain that it worked).

This is the Start URL:
https://skillsforall.com/launch?id=437dd255-f560-43e4-aa3c-34185fc916da&tab=learning&assignment=e58d98dd-9870-4b8e-88d3-b04738a708a2&activeTab=assignmentdetails

Here are my three blocking rules that try to catch queries containing the keyword curriculum (or tab=curriculum):

?id=437dd255-f560-43e4-aa3c-34185fc916da&tab=curriculum*
^https:\/\/skillsforall\.com\/launch\?id=437dd255-f560-43e4-aa3c-34185fc916da&tab=curriculum(.*)$
skillsforall.com/launch?id=437dd255-f560-43e4-aa3c-34185fc916da&tab=curriculum*

The user manual states that "URL parameters like a query string can be indicated and always have to start with the character '?'. The wording here is a bit vague IMO. I thought this meant filter rules can begin with the character '?'.

[danschlet]

The manual also states (in the beginning of the section "Format for a filter expression in the non-regex format:"

The host field is required (besides when filtering against a protocol like about:blank or data:), and is either a partial or full hostname or an IP address. It can also contain or be replaced completely with the wildcard '*' char, see below for details. The URL filter doesn't resolve hostnames itself, so if you allow everything and only block 'hostname.com', then that host could still be reached using its IP address. You should therefore mainly use whitelisting to allow accessing only specific sites during an exam.

So obviously a rule cannot begin with the character "?".