📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

Thank you @touchweb-vincent. This looks good.

Are there situations where console.log could be used in standard (development) situations?

I'd say yes, but it's much more likely an information leakage we want to avoid. But let's have the conversation on record.

@dune73 Maybe, I don’t know the NodeJS ecosystem very well, but it's already caught by 941390 - I hadn’t checked before. So I removed it.

curl -H "x-format-output: txt-matched-rules" -H "x-crs-paranoia-level:4" "http://sandbox.coreruleset.org/" -d 'test=console.log(1);'
941390 PL1 Javascript method detected

Done @EsadCetiner - in a comment like this one:
https://github.com/coreruleset/coreruleset/blob/main/tests/regression/tests/REQUEST-941-APPLICATION-ATTACK-XSS/941380.yaml

console.log is already covered by 941390. Do you still want to catch it in 934100?
If yes, could you please explain how to override the console-funcs variable from the RA file?
https://github.com/coreruleset/coreruleset/blob/main/regex-assembly/934100.ra#L183

@touchweb-vincent Sorry, I'm not sure what change your exactly trying to make. What's wrong with just adding console.log like in your earlier commit?

Following our discussion on Slack, it's done. Thanks for the help.