Rule idea: Multiple parameters with the same name

_Issue originally created by user dune73 on date 2016-07-12 04:34:42. Link to original issue: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/400._

Can we do a rule that checks if a parameter name has been submitted multiple times? I think this should be possible with a counter as TX:paramcounter_<param-name> and then check @gt on TX:/^paramcounter_.*/.

Naturally, this would be a PL3 or PL4 rule.

[CRS-migration-bot]

User dune73 commented on date 2016-07-12 14:08:24:

The overhead was another reason I would prefer to keep this at a higher PL. 😉

[CRS-migration-bot]

User marcstern commented on date 2016-07-12 07:43:58:

It's not because I'm not USING the CRS that I'm not following them
;-)

On 12-07-2016 08:58, Christian Folini
  wrote:



  **csanders**-git
    I think your approach does not work, because TX.0 is always the
    last match and your first rule in the chain is first executed
    for all ARGS_NAMES and then the second rule in the
    chain is executed for all ARGS_NAMES that matched on the first
    rule with the last ARGS_NAME which matched in TX.0.
  **marcstern** Exactly the idea I had in
    mind. Thank you for the proof of concept of the idea. 
    I think the rule with 2 is not really necessary, or is it. (Good
    to read you here. I was not aware you were following the CRS.)
  —
    You are receiving this because you were mentioned.
    Reply to this email directly, view
      it on GitHub, or mute
      the thread.