Enum HppStrategy 

pub enum HppStrategy {
    DuplicateFirst {
        decoy: String,
    },
    DuplicateLast {
        decoy: String,
    },
    ArrBracket,
}

HTTP Parameter Pollution variant.

HPP exploits the gap between which value a WAF parses (almost always the first occurrence of a duplicate key) and which value the backend parses (PHP/Express/Django/Rails typically take the LAST; arrays — param[]= — preserve all). A safe-looking pair on the WAF-visible side carries the WAF inspection while the backend reads the attack payload from a duplicate.

Pre-R74 the UrlStrategy::Hpp variant was a documented stub — apply_bytes only sees one value, so it had no way to add a second pair. The architectural fix lives here, operating on the (name, value) pair list directly.

Pass 21 R74 — closes pass-20 F4 / Innovation-audit F1 (LAW 1 stub).

Variants

DuplicateFirst

param=attack → param=safe&param=attack. WAFs that take the first value see safe; backends that take the last see the attack. Most common HPP form in 2024–2026 real-world bypasses.

Fields

decoy: String

The “safe” value the WAF will inspect.

DuplicateLast

param=attack → param=attack&param=safe. Inverse — backends that take FIRST see the attack while WAFs that scan ALL pairs dilute their attention with a benign trailer.

Fields

decoy: String

The “safe” value emitted after the attack value.

ArrBracket

param=attack → param[]=attack. PHP-style array syntax. Some Spring / Django middleware re-routes param[] to the same handler that reads param, while WAF rules anchored on the literal param= miss the bracketed form.

Implementations

impl HppStrategy

pub fn label(&self) -> &'static str

Stable technique label for the gene-bank.

Trait Implementations

impl Clone for HppStrategy

fn clone(&self) -> HppStrategy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HppStrategy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for HppStrategy

impl PartialEq for HppStrategy

fn eq(&self, other: &HppStrategy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for HppStrategy