- assigned_to: EJP
The existing Rules are inflexible and difficult to extend. For example, OnlyHttpProtocolRule would need to be supplemented by OnlyHttpsProtocolRule and OnlyHttpOrHttpsProtocolRule for more generality, and it explodes combinatorially the more protocols you want to support.
Replace this rule with an AllowProtocolsRule that takes a configuration parameter which is a regular expression that encodes which protocol(s) are to be allowed. Provide a corresponding DenyProtocolsRule that denies whatever protocols are similarly specified, in both cases so as to allow both multiple protocols via | and wildcard protocol specifications.
The same objection applies to TextHtmlMimeTypeOnlyRule: replace with Allow/DenyMimeTypesRule that also take a configurable regular expression, so as to allow both multiple mime types via | and wildcard mime type specifications.
ForbiddenPathRule could also usefully use a regular expression instead of a literal text specification.
A DenyHttpStatus rule would also be useful for 301-304, 307, etc.