📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

I'm not a fan of hardcoding these values. I've thought about using the delimiter technique with @within (https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-%28v2.x%29#within), but I don't see how we can make it work better than what you already have.

I also don't think the delimiter technique described for @pmFromFile will work in this case.

Let's ask for more ideas.

Actually, I tried to use a macro with @rx and it seems to work with both httpd and nginx:

SecRule MATCHED_VAR "@rx (?i)%{MATCHED_VAR}\s" \

@theseion

I'm not a fan of hardcoding these values.

Agreed, but the only other solution I see is moving to a regex.

Actually, I tried to use a macro with @rx and it seems to work with both httpd and nginx:

aah I see what happened, you originally mentioned using @rx %{MATCH_DATA}\b which isn't valid, I autocorrected it to @rx %{MATCHED_DATA}\b which is what I used when I tested the rule but I didn't pick up on the other mistake.

After digging a bit deeper, I can see this won't work as well because there are some entries such as:

wp-config-
wp-config.
wp-config_

which is intentionally meant to match permutations, adding a word boundary for all entries will result in false negatives. I'll add some tests for this case as the tests are a bit bare for this rule.