Blocking what's allowed—denying everything else

So how do we actually implement the positive security model where that which we explicitly allow can pass through and everything else is blocked? Say for example that an argument named foo must have a value of bar, and that any other value for foo should be blocked. One approach would be the following:

SecRule ARGS:foo "!^bar$" "deny"

This works fine and will block any value for foo other than bar. It will even work in cases where foo isn't specified in the query string, since the rule will not be evaluated if the foo argument isn't present. However, what if someone decided to provide an argument named fox in the query string, just to see what would happen? According to our security model, we should block any argument that isn't explicitly whitelisted, so the presence of an argument named fox should lead to a denied request. It's clear that we need to add another check to make sure that only whitelisted argument names are allowed through.

The...