How are settings (methods, OWASP) combined during a Merge?

Short answer

The merged rule starts with a copy of the first checked rule; the other rules are extended onto it in order and the rule takes a new ID (merging the settings). Allowed Methods: if one of the rules is Any Methods, the result becomes Any methods, Multiple Methods lists are merged, and None leaves it to the value of the other rule. Numeric restrictions (Path Length, Path Depth and the length, count, size and depth in Check Fields): the range that covers the limits of both sides is taken, and the side that is No Restriction is not taken into account. If OWASP and OWASP Check are off in one of the rules, they are also off in the merged rule. Allowed lists (Allowed … and Allowed … Mime Types) are merged; if they exceed the Max. Allowed Arguments limit, the list is emptied and the restriction is lifted. Required lists (Required …) are intersected. OWASP Exclusions lists are merged; if the union exceeds the Max. OWASP Exclusions limit, the list is emptied and signature scanning is turned off at that location (OWASP on the path, OWASP check in the section or the argument). In the other settings, such as value patterns, blocking switches and … value count, the value of the first rule is preserved. Check fields rules that belong to the same section and argument are combined into a single rule, and the others are added.

How Does It Work?

1. All the settings and Check fields rules of the first checked rule are copied; the Merge Path is written as the path and the rule takes a new ID.
2. Each following rule is processed field by field onto this copy (the table below).
3. Check fields rules that belong to the same section and the same argument are combined; rules that have no counterpart in the copy are added as they are.

Field-by-Field Combination

Field	Combination rule
Allowed methods	One is Any Methods → Any methods · Multiple Methods ∪ Multiple methods · None leaves it to the value of the other rule
Path length, Path depth; … Key Length, … Key Count, Total … Size, Raw Body Size, JSON Depth, XML Depth, … Value Length in Check fields	The smallest of the lower limits and the largest of the upper limits; if the lower and upper limits are equal, Equals To. The side that is No Restriction is not taken into account; if both sides are No restriction, the result is No restriction
OWASP (path) · OWASP check (section and argument)	Off if it is off in one of the rules; otherwise, on if one of them is on
OWASP exclusions	The lists are merged; an empty list does not delete the exclusions of the other rule. If the union exceeds the Max. OWASP Exclusions limit, OWASP (path) or OWASP check is turned off at that location and the list is emptied
Allowed Query Parameters, Allowed Headers, Allowed Form Fields, Allowed JSON Keys, Allowed XML Keys, Allowed Upload Mime Types, Allowed Raw Body Mime Types	The lists are merged; if the list of the first rule is empty (no restriction), the result is also unrestricted, and if the list of the following rule is empty, the list of the first rule is preserved; if the union exceeds the Max. Allowed Arguments limit, the list is emptied and the restriction is lifted (What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?)
Required Query Parameters, Required Headers, Required Form Fields	Intersection (only the ones present in both rules)
… Value Pattern (value patterns)	The value of the first rule (an empty pattern also counts as a value); the pattern of the following rule is taken only if this field was never saved in the first rule
Block All … Contents, Block Invalid … Contents, Block Unparsed Contents, Block Unexpected Parser Errors, … Value Count, Detailed Log and the others	The value of the first rule
Check fields rules	Same section and same argument → combined into a single rule; different → added

• In the limit behavior, an "emptied" allowed list means no restriction. If the OWASP exclusions union exceeds the limit, the list is emptied and OWASP (path) or OWASP check is turned off at the same location, that is, signature scanning is turned off on that path, in that section or in that argument. This is the same as the behavior that learning applies at the same limit (Max. OWASP Exclusions).
• The merged rule takes a new ID; the IDs of the rules that come from learning are not carried over.
• The Combine with Old Rules option in the analysis is a different operation (What is the difference between "Create New Rules" and "Combine with Old Rules" in the analysis?).

Common Misconceptions

• "Merge selects the strictest setting." Merge widens: method lists, allowed lists and OWASP exclusions lists are merged, numeric ranges widen and OWASP scanning that is off in one of the rules also stays off in the merged rule; required lists, on the other hand, narrow.
• "Allowed lists are merged under every condition." If the union exceeds the Max. Allowed Arguments limit, the list is emptied and the list restriction is lifted in that field.
• "An unrestricted (No restriction) rule makes the combination unrestricted." The side that is No restriction is not taken into account; the limit of the other rule passes to the merged rule.

How it is done in the documentation

• Merge · Merging the Settings
• Merge · The Runtime Effect
• Checks · Max. Allowed Arguments
• OWASP Protection Level · Max. OWASP Exclusions

Related questions

• How do I merge several page types into one rule (Merge)?
• What do the Force Merge and Keep Original Rules options do?
• Can I define required parameters (Required Query Parameters / Required Headers / Required Form Fields)?