coreruleset · azurit · Dec 8, 2025 · Nov 17, 2025 · Nov 17, 2025 · Nov 17, 2025
diff --git a/regex-assembly/942440-chain1.ra b/regex-assembly/942440-chain1.ra
@@ -10,16 +10,14 @@
 ##!> define base64-urlencoded-charset [a-zA-Z0-9_-]+
 ##!> define dot [.]
 
-##!^ ^ey
+##!^ ^
 
-{{base64-urlencoded-charset}}
+##!> assemble
+  ey{{base64-urlencoded-charset}}{{dot}}ey{{base64-urlencoded-charset}}{{dot}}{{base64-urlencoded-charset}}
+##!<
 
-##!=>
-
-{{dot}}ey{{base64-urlencoded-charset}}
-
-##!=>
-
-{{dot}}{{base64-urlencoded-charset}}
+##!> assemble
+  [\w-]+
+##!<
 
 ##!$ $
diff --git a/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf b/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
@@ -1317,38 +1317,6 @@ SecRule ARGS_NAMES|ARGS|XML:/* "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´
     setvar:'tx.inbound_anomaly_score_pl2=+%{tx.warning_anomaly_score}',\
     setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'"
 
-#
-# -=[ Exclusion rule for 942440 ]=-
-#
-# Prevent FPs against Facebook click identifier
-#
-SecRule ARGS_GET:fbclid "@rx [a-zA-Z0-9_-]{61,61}" \
-    "id:942441,\
-    phase:2,\
-    pass,\
-    t:none,\
-    nolog,\
-    tag:'OWASP_CRS',\
-    tag:'OWASP_CRS/ATTACK-SQLI',\
-    ctl:ruleRemoveTargetById=942440;ARGS:fbclid,\
-    ver:'OWASP_CRS/4.22.0-dev'"
-
-#
-# -=[ Exclusion rule for 942440 ]=-
-#
-# Prevent FPs against Google click identifier
-#
-SecRule ARGS_GET:gclid "@rx [a-zA-Z0-9_-]{91,91}" \
-    "id:942442,\
-    phase:2,\
-    pass,\
-    t:none,\
-    nolog,\
-    tag:'OWASP_CRS',\
-    tag:'OWASP_CRS/ATTACK-SQLI',\
-    ctl:ruleRemoveTargetById=942440;ARGS:gclid,\
-    ver:'OWASP_CRS/4.22.0-dev'"
-
 #
 # -=[ Detect SQL Comment Sequences ]=-
 #
@@ -1372,7 +1340,9 @@ SecRule ARGS_GET:gclid "@rx [a-zA-Z0-9_-]{91,91}" \
 # -------------------------
 #
 # The chained rule is designed to prevent false positives by specifically
-# targeting JWT tokens. Starting with 'ey' targets JWT tokens, where the 'ey'
+# targeting JWT tokens and common tokens (brid, fbclid, gclid, recaptcha, ttclid, etc).
+#
+# Starting with 'ey' targets JWT tokens, where the 'ey'
 # prefix corresponds to the beginning of the Base64-encoded header section.
 #
 # example:
@@ -1404,7 +1374,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NA
     ver:'OWASP_CRS/4.22.0-dev',\
     severity:'CRITICAL',\
     chain"
-    SecRule MATCHED_VARS "!@rx ^ey[\-0-9A-Z_a-z]+\.ey[\-0-9A-Z_a-z]+\.[\-0-9A-Z_a-z]+$" \
+    SecRule MATCHED_VARS "!@rx ^(?:ey[\-0-9A-Z_a-z]+\.ey[\-0-9A-Z_a-z]+\.)?[\-0-9A-Z_a-z]+$" \
         "t:none,\
         setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}',\
         setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"

diff --git a/tests/regression/tests/REQUEST-942-APPLICATION-ATTACK-SQLI/942440.yaml b/tests/regression/tests/REQUEST-942-APPLICATION-ATTACK-SQLI/942440.yaml
@@ -1,6 +1,6 @@
 ---
 meta:
-  author: "Christian S.J. Peron, Max Leske, azurit"
+  author: "Christian S.J. Peron, Max Leske, azurit, touchweb_vincent"
 rule_id: 942440
 tests:
   - test_id: 1
@@ -335,3 +335,96 @@ tests:
         output:
           log:
             no_expect_ids: [942440]
+  - test_id: 21
+    desc: "False positive against ReCaptcha Token - truncated at 1024 chars for the linter"
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+          method: "POST"
+          port: 80
+          version: "HTTP/1.1"
+          uri: "/get"
+          data: "recaptchaToken=0cAFcWeA5Q9qneoy5svp-ow9uyksp1u8sdCA2it1v80Rwl-bn0dpYRQ1btnvXVw5Im6Y_3pmpZe8MZrDhXYmHL0BejWDB3sFBRF1NG1FOR0jCDb3KMsIMwqZl-0x0LSotoGHaltCfASwYfm5lYf5g8tZA_IciJIesdbPZ3d8lxKAyRM-NQjCPBmyQAakve6wo0I52vKBUpju4ngxfbItIHoGE5pfBfncWTPsIMdHaXCzUs-SN298tv2LoHGb_cV1Xy91VmyiW79yRu-x3e176VYsQ404bMwv4mIf9ATJV_QI-ygbxIMHQ62hNNaZp8pVAX2TKRx5jqEyc2iNZGUlwPYKnHZn2AjSoKFNbxxCNAbdu_QV3aPN8RbudCLvXOwGRcX0mULEte8OMzkB8B8Ih5HT1AiOhLMAah2CM6533LHEDQRsK-8ykmZUN4m3qM9tcQBd7ZFQAy--_SV4qUOWZC8laMtDCIj4cnpZ8FF1RIizocdrE7YhOoSeB8XEYnr0A3WP-vpJ58Cdy5OtypswnizLTXUf1gMsgYfTr4PBc0rBq8_E54qinjHNxe1Y_MiMqXegVMsGS_llQjUws8NITFEetlBK0JuK9WH-0kuimcd4EF1ChzMRJV5Ps22QfAT5qIqPQGlVycL3FXrDZMWT1igkbU2hnLwJl6MD1SoZfeOSxt5nq6WxL2qYtWJd8w-dXQ3hQ5iz0WBldlntF2jOo13n6rraaD4h7JuDdqyBD_zr_WZ84n5CVf5myNcdaOu4r4tj5IHp4GBfXe5jIomtyuSqlPh_-9o9VWFW-9ReL5LrwArMAsHodADbfhu9AviIYIGCRAE2OnTGlbgREWDS8IWAuoeasA1ZmlVv6O3gzEl7W7tUlCmceMIjlyrUaPAGHSUgYJWQoIM1pW8lgmbZtaugbkA3DcfL5hW-AmTZg53-o0BQ"
+        output:
+          log:
+            no_expect_ids: [942440]
+  - test_id: 22
+    desc: "False positive against ReCaptcha Token - truncated at 1024 chars for the linter"
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+          method: "POST"
+          port: 80
+          version: "HTTP/1.1"
+          uri: "/get"
+          data: "g-recaptcha-response=0cAFcWeA5Q9qneoy5svp-ow9uyksp1u8sdCA2it1v80Rwl-bn0dpYRQ1btnvXVw5Im6Y_3pmpZe8MZrDhXYmHL0BejWDB3sFBRF1NG1FOR0jCDb3KMsIMwqZl-0x0LSotoGHaltCfASwYfm5lYf5g8tZA_IciJIesdbPZ3d8lxKAyRM-NQjCPBmyQAakve6wo0I52vKBUpju4ngxfbItIHoGE5pfBfncWTPsIMdHaXCzUs-SN298tv2LoHGb_cV1Xy91VmyiW79yRu-x3e176VYsQ404bMwv4mIf9ATJV_QI-ygbxIMHQ62hNNaZp8pVAX2TKRx5jqEyc2iNZGUlwPYKnHZn2AjSoKFNbxxCNAbdu_QV3aPN8RbudCLvXOwGRcX0mULEte8OMzkB8B8Ih5HT1AiOhLMAah2CM6533LHEDQRsK-8ykmZUN4m3qM9tcQBd7ZFQAy--_SV4qUOWZC8laMtDCIj4cnpZ8FF1RIizocdrE7YhOoSeB8XEYnr0A3WP-vpJ58Cdy5OtypswnizLTXUf1gMsgYfTr4PBc0rBq8_E54qinjHNxe1Y_MiMqXegVMsGS_llQjUws8NITFEetlBK0JuK9WH-0kuimcd4EF1ChzMRJV5Ps22QfAT5qIqPQGlVycL3FXrDZMWT1igkbU2hnLwJl6MD1SoZfeOSxt5nq6WxL2qYtWJd8w-dXQ3hQ5iz0WBldlntF2jOo13n6rraaD4h7JuDdqyBD_zr_WZ84n5CVf5myNcdaOu4r4tj5IHp4GBfXe5jIomtyuSqlPh_-9o9VWFW-9ReL5LrwArMAsHodADbfhu9AviIYIGCRAE2OnTGlbgREWDS8IWAuoeasA1ZmlVv6O3gzEl7W7tUlCmceMIjlyrUaPAGHSUgYJWQoIM1pW8lgmbZtaugbkA3DcfL5hW-AmTZg53-o0BQ"
+        output:
+          log:
+            no_expect_ids: [942440]
+  - test_id: 23
+    desc: "False positive against ReCaptcha v3 Token - truncated at 1024 chars for the linter"
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+          method: "POST"
+          port: 80
+          version: "HTTP/1.1"
+          uri: "/get"
+          data: "recaptcha-v3-token=0cAFcWeA5Q9qneoy5svp-ow9uyksp1u8sdCA2it1v80Rwl-bn0dpYRQ1btnvXVw5Im6Y_3pmpZe8MZrDhXYmHL0BejWDB3sFBRF1NG1FOR0jCDb3KMsIMwqZl-0x0LSotoGHaltCfASwYfm5lYf5g8tZA_IciJIesdbPZ3d8lxKAyRM-NQjCPBmyQAakve6wo0I52vKBUpju4ngxfbItIHoGE5pfBfncWTPsIMdHaXCzUs-SN298tv2LoHGb_cV1Xy91VmyiW79yRu-x3e176VYsQ404bMwv4mIf9ATJV_QI-ygbxIMHQ62hNNaZp8pVAX2TKRx5jqEyc2iNZGUlwPYKnHZn2AjSoKFNbxxCNAbdu_QV3aPN8RbudCLvXOwGRcX0mULEte8OMzkB8B8Ih5HT1AiOhLMAah2CM6533LHEDQRsK-8ykmZUN4m3qM9tcQBd7ZFQAy--_SV4qUOWZC8laMtDCIj4cnpZ8FF1RIizocdrE7YhOoSeB8XEYnr0A3WP-vpJ58Cdy5OtypswnizLTXUf1gMsgYfTr4PBc0rBq8_E54qinjHNxe1Y_MiMqXegVMsGS_llQjUws8NITFEetlBK0JuK9WH-0kuimcd4EF1ChzMRJV5Ps22QfAT5qIqPQGlVycL3FXrDZMWT1igkbU2hnLwJl6MD1SoZfeOSxt5nq6WxL2qYtWJd8w-dXQ3hQ5iz0WBldlntF2jOo13n6rraaD4h7JuDdqyBD_zr_WZ84n5CVf5myNcdaOu4r4tj5IHp4GBfXe5jIomtyuSqlPh_-9o9VWFW-9ReL5LrwArMAsHodADbfhu9AviIYIGCRAE2OnTGlbgREWDS8IWAuoeasA1ZmlVv6O3gzEl7W7tUlCmceMIjlyrUaPAGHSUgYJWQoIM1pW8lgmbZtaugbkA3DcfL5hW-AmTZg53-o0BQ"
+        output:
+          log:
+            no_expect_ids: [942440]
+  - test_id: 24
+    desc: "FYI : Turnstile token are still matched - truncated at 1024 chars for the linter"
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+          method: "POST"
+          port: 80
+          version: "HTTP/1.1"
+          uri: "/get"
+          data: "cf-turnstile-response=0.mhOs6JFXLHyE21dFS41Px17BxIjQ-2qlB17IBR0wpgtUrnn92qN-x2t-mpmTMZeQBZlZN2G06An5OfFsslwkkYBAGO7l6t-D-HVqMNj-GNTBGwf5G81d-NYlhnPZmWymFvh1TlMVDv9b-rnYm4WJP-dPhQTRphc1hWgZkRHS6XS6ecGCyNcNzezF0zp6owHNIneLlmTc7pVSbOByN7T12E5KMqpd-ppYnlfKG81zIj8Tl9p_KBe6g0FVstsDEwWC-GvHlWIpQRK_4FVxu7_cpX9DoHSsMHz6R8VYc4L7naYmC0yRL3BWDLEvSM5kEvTjrpXHwGJ8NJkghxRJcu94yuoZXEjl-S9PsoNe-1oom-AeG2-7RnPAb6a-E0pNXxFG8Qv2nEz6GGFnyjWsCMfJVtLeHlSx77U3srcO65_unYlWYCP-GfdanjgnfM8d2bv14yankU2OaFDg9ntjgbOBWT0_PpeAXm1MQTinYO8wj8AOJzIWi5jekHwEgqAicFnGQnHVnpmEoi-kipLYTcQW0fVhKAn-w7BhIJTdaGN-LbqKu8fPLy-j0hF_j4VZPSIEMCQcJ3dB-3QuUbz6DWtuGFGXOhD-B-fIaoEZOuQKToCvycxwXVH79mjZ655pDT9WEuzl85uWYBozMxiBrBhwZHVUm8dAi19tLsfYnu8VOvXI8sHOYH-aDIjYAUR9r4NY9YB8tx-EMGZif8DT4DUXn---eZ1xosWJE2TTxLr3JyN5Bn5OagrL2BAC9a_H4JZ14fl5hPfKl_Hx8raT8t7s03aaJZ-WLUMpujHUbAQZDmtuGQ89tr3KJDqwSvaG2ENB6B5kVv4gBwLbsTx4Apam6Grz4UkgQl81FzSGuU-VTOyxpUuUWq56QhOjdzhgjBxIUm2PkVenWYEJPJSnmZgBVGCje_uqtMSUteCBfWhkPxR"
+        output:
+          log:
+            expect_ids: [942440]
+  - test_id: 25
+    desc: "False positive against Facebook (2025 - brid) Token"
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+          method: "GET"
+          port: 80
+          version: "HTTP/1.1"
+          uri: "/get?brid=DLZJ9w0c--9DeBML6-QCPI_2g"
+        output:
+          log:
+  - test_id: 26
+    desc: "False positive against PrestaShop / Wordpress URL slug"
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+          method: "GET"
+          port: 80
+          version: "HTTP/1.1"
+          uri: "/get?url_slug=my--slugified-url"
+        output:
+          log:
+            no_expect_ids: [942440]