# How many args in $args?

**URL:** <https://www.ruby-forum.com/t/how-many-args-in-args/217644>\
**Category:** NGINX\
**Created:** [March 7, 2012, 11:10am UTC](https://www.ruby-forum.com/t/how-many-args-in-args/217644 "2012-03-07T11:10:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [March 7, 2012, 11:10am UTC](https://www.ruby-forum.com/t/how-many-args-in-args/217644/1 "2012-03-07T11:10:24Z")

</div>

Is there some means of determining how many query parameters are being  
passed, by looking $args, say? There’s a kind of DOS attack which can  
bring down Java based webapps which do binding of request parameters to  
properties, and it seems to me that nginx used as a remote proxy server  
could probably prevent this simply by rejecting requests which had more  
than x query parameters.

---

<div class="post-metadata">

**Author:** ![jmaenpaa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/9de053/32.png) [@jmaenpaa](https://www.ruby-forum.com/u/jmaenpaa)\
**Post date:** [March 7, 2012, 11:25am UTC](https://www.ruby-forum.com/t/how-many-args-in-args/217644/2 "2012-03-07T11:25:23Z")

</div>

Hello!

On Wed, Mar 07, 2012 at 10:09:38AM +0000, John M. wrote:

> Is there some means of determining how many query parameters are being  
> passed, by looking $args, say? There’s a kind of DOS attack which can  
> bring down Java based webapps which do binding of request parameters to  
> properties, and it seems to me that nginx used as a remote proxy server  
> could probably prevent this simply by rejecting requests which had more  
> than x query parameters.

Something like

```
if ($args ~ "(?:[&;][^&;]*){50,}") {
    return 403;
}

```

should do the trick.

Maxim D.

---

<div class="post-metadata">

**Author:** ![jmaenpaa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/9de053/32.png) [@jmaenpaa](https://www.ruby-forum.com/u/jmaenpaa)\
**Post date:** [March 7, 2012, 11:31am UTC](https://www.ruby-forum.com/t/how-many-args-in-args/217644/3 "2012-03-07T11:31:40Z")

</div>

On Wednesday 07 March 2012 14:09:38 John M. wrote:

> Is there some means of determining how many query parameters are being  
> passed, by looking $args, say? There’s a kind of DOS attack which can  
> bring down Java based webapps which do binding of request parameters to  
> properties, and it seems to me that nginx used as a remote proxy server  
> could probably prevent this simply by rejecting requests which had more  
> than x query parameters.

You can simple utilize regexp functionality for such task, i.e.:

if ($args ~ “^(?:[^&]+&){16}”) {  
return 403;  
}

> **[Module ngx\_http\_rewrite\_module](http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#if)**
>
> The ngx\_http\_rewrite\_module module is used to change request URI using PCRE regular expressions, return redirects, and conditionally select configurations.

wbr, Valentin V. Bartenev