Skip to content

[feature request] operator to count number of matches from file #936

Open

Description

@sam-hobbs

I'd love to see a feature similar to @pmFromFile that counts the number of matches instead of returning a boolean.

I've been using ModSecurity for about a year and I've found that the available operators allow me to achieve most things I can think of fairly gracefully. However, the one operator I feel is missing is something similar to @pmFromFile that returns the number of matches instead of a boolean.

I believe this would make ModSecurity much more useful for dealing with comment spam, particularly when combined with the existing RBL capabilities.

I'm hoping to put a list of keywords in a file and use the number of matches returned by the operator to increment a transaction variable for comment spam. No doubt it would be useful for other things too!

I think the best way to achieve this with the current tools is probably to call a lua script, but I feel like this would probably be less efficient than a built-in operator. I doubt I'm the first person to think of using ModSecurity in this way, so is there any chance we could add this feature?

Activity

  1. self-assigned this
    on Sep 28, 2015
  2. added this to the v3.0.4 milestone on Nov 9, 2018
  3. fzipi commented on Oct 12, 2026

    @fzipi
    Collaborator

    Revisiting this one. Not available in either branch: @pm / @pmFromFile are boolean and there is no counting variant. The closest workaround is a Lua script, as the report says. No comments in ten years.

    Decide: implement a counting variant (for example an operator that sets a TX variable with the match count) or close. Needs a maintainer decision.

  4. added
    3.xRelated to ModSecurity version 3.x
    needs decisionTriage done; a maintainer needs to make the final call
    on Oct 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions