owasp-modsecurity / owasp-modsecurity/ModSecurity

[feature request] operator to count number of matches from file

Open
#936 0 comments 1 reaction 1 assignee View on GitHub

@zimmerle is already working on this.

Since Sep 28, 2015.

enhancement RIP - libmodsecurity RIP - Type - Feature TBF by libmodsec waiting for v3
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

I'd love to see a feature similar to @pmFromFile that counts the number of matches instead of returning a boolean.

I've been using ModSecurity for about a year and I've found that the available operators allow me to achieve most things I can think of fairly gracefully. However, the one operator I feel is missing is something similar to @pmFromFile that returns the number of matches instead of a boolean.

I believe this would make ModSecurity much more useful for dealing with comment spam, particularly when combined with the existing RBL capabilities.

I'm hoping to put a list of keywords in a file and use the number of matches returned by the operator to increment a transaction variable for comment spam. No doubt it would be useful for other things too!

I think the best way to achieve this with the current tools is probably to call a lua script, but I feel like this would probably be less efficient than a built-in operator. I doubt I'm the first person to think of using ModSecurity in this way, so is there any chance we could add this feature?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.