# Preventing args other than list

**URL:** <https://www.ruby-forum.com/t/preventing-args-other-than-list/196320>\
**Category:** NGINX\
**Created:** [October 11, 2010, 5:44pm UTC](https://www.ruby-forum.com/t/preventing-args-other-than-list/196320 "2010-10-11T17:44:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mflive](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e99b99/32.png) [@mflive](https://www.ruby-forum.com/u/mflive)\
**Post date:** [October 11, 2010, 5:44pm UTC](https://www.ruby-forum.com/t/preventing-args-other-than-list/196320/1 "2010-10-11T17:44:07Z")

</div>

Hi list,

We’re having an upstream server that can accept many different  
parameters. Most  
query string parameters can be predefined in the backend itself but some  
cannot  
because they are unpredictable.

We’d like to configure our proxy as to only allow a set of parameters  
that we  
want to define in Nginx. Configuring the list in a map seems easy, but  
comparing  
it to the actual query parameters seems hard.

I know how i can test on availability of parameters by using  
$args\_PARAMETER  
and the if directive. But just as in the backend, we wan’t to inverse  
the  
list. We need to define what IS allowed, not wat ISN’T allowed.

Any suggestions on how to procede?

Cheers,

–  
Markus J. - CTO - Openindex  
[http://www.linkedin.com/in/markus17](http://www.linkedin.com/in/markus17)  
050-8536600 / 06-50258350

---

<div class="post-metadata">

**Author:** ![mflive](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e99b99/32.png) [@mflive](https://www.ruby-forum.com/u/mflive)\
**Post date:** [October 11, 2010, 6:09pm UTC](https://www.ruby-forum.com/t/preventing-args-other-than-list/196320/2 "2010-10-11T18:09:18Z")

</div>

----- Markus J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I know how i can test on availability of parameters by using $args\_PARAMETER  
> and the if directive. But just as in the backend, we wan’t to inverse the  
> list. We need to define what IS allowed, not wat ISN’T allowed.
> 
> Any suggestions on how to procede?

The only solution I know that doesn’t require low level coding is build  
in perl.

–  
Regards,  
Valery K.

---

<div class="post-metadata">

**Author:** ![mflive](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e99b99/32.png) [@mflive](https://www.ruby-forum.com/u/mflive)\
**Post date:** [October 11, 2010, 6:21pm UTC](https://www.ruby-forum.com/t/preventing-args-other-than-list/196320/3 "2010-10-11T18:21:00Z")

</div>

I see, thanks for the suggestion. We’ll consider it!

On Monday, October 11, 2010 06:08:09 pm Valery K. wrote:

> > I know how i can test on availability of parameters by using  
> > $args\_PARAMETER and the if directive. But just as in the backend, we  
> > wan’t to inverse the list. We need to define what IS allowed, not wat  
> > ISN’T allowed.
> > 
> > Any suggestions on how to procede?
> 
> The only solution I know that doesn’t require low level coding is build in  
> perl.

–  
Markus J. - CTO - Openindex  
[http://www.linkedin.com/in/markus17](http://www.linkedin.com/in/markus17)  
050-8536600 / 06-50258350

---

<div class="post-metadata">

**Author:** ![mflive](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e99b99/32.png) [@mflive](https://www.ruby-forum.com/u/mflive)\
**Post date:** [October 11, 2010, 6:36pm UTC](https://www.ruby-forum.com/t/preventing-args-other-than-list/196320/4 "2010-10-11T18:36:13Z")

</div>

Hello!

On Mon, Oct 11, 2010 at 05:08:09PM +0100, Valery K. wrote:

> > it to the actual query parameters seems hard.
> > 
> > I know how i can test on availability of parameters by using $args\_PARAMETER  
> > and the if directive. But just as in the backend, we wan’t to inverse the  
> > list. We need to define what IS allowed, not wat ISN’T allowed.
> > 
> > Any suggestions on how to procede?
> 
> The only solution I know that doesn’t require low level coding is build in perl.

I believe apropriate checks may be easily written with regexp,  
e.g. this one will allow only arg1 and arg2 arguments:

if ($args !~ “^(((arg1|arg2)=[^&;]_)([&;]+((arg1|arg2)=[^&;]_))\*)?$”)  
{  
return 403;  
}

(“?:” omitted for clarity)

The only downside that it uses “if”, which is known to be evil  
([GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/IfIsEvil)). Though this one is safe even in  
location context as it uses “return”.

Maxim D.

---

<div class="post-metadata">

**Author:** ![mflive](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e99b99/32.png) [@mflive](https://www.ruby-forum.com/u/mflive)\
**Post date:** [October 11, 2010, 11:41pm UTC](https://www.ruby-forum.com/t/preventing-args-other-than-list/196320/5 "2010-10-11T23:41:28Z")

</div>

Ah yes, using an regex didn’t come to mind. We’ll check if it works.

Thanks!