Actually I needed to fix this for a customer and came up with a workaround using findstr (
Click here).
I'm guessing this would be faster than a loop or a regex. Replace $query with [HTTP::query] and update the skip count in the findstr commands based on how long the parameter name you're looking for is. You could calculate the skip count in the rule, but that would be less efficient.
when RULE_INIT {
Find the value for the first instance of a parameter name of "aa" in the query string
Test query string
set query "aaa=111&aa=11&a=1&aa=22"
Test query string
set query "aa=11"
The parameter name to get the value for
set param_name aa
Check if query string starts with the parameter name and =.
Need to hardcode the length of the parameter name + 1 for findstr
if {$query starts_with "$param_name="}{
log local0. "$param_name = [findstr $query "$param_name=" 3 &]"
} else {
Parameter wasn't at the start of the query string, so check for ¶m_name= in the query string
Need to hardcode the length of the parameter name + 2 for findstr
log local0. "$param_name = [findstr $query "&$param_name=" 4 &]"
}
log local0. "Incorrect value from URI::query: $param_name = [URI::query ?$query $param_name]"
}
Aaron