Proposed changes

• Fixing regex which was too wide and was triggered by unrelated keywords accross whole response body.
• Removing part of the regex because:

1. I wasn't able to find any error messages returned by MaxDB which matched that part of the regex.
2. Regex was wrong from the beginning anyway as it was supposed to match strings containing keywords like POS(8) but brackets were not escaped and were later removed probably because we considered them as excessive group in regex (regex changed from POS([0-9]+) to POS[0-9]+).

These are the only error messages i was able to find on the net:

PHP Warning:  maxdb_query(): -4005 POS(8) Unknown column name:XXX [42000]
PHP Warning:  maxdb_connect(): -4008 POS(1) Unknown user name/password combination <...>
PHP Warning: maxdb::query():  -4004 POS(15) Unknown table name:CALCULATE_RETURN [42000]

PR Checklist

• I have read the CONTRIBUTING doc
• I have added positive tests proving my fix/feature works as intended.
• I have added negative tests that prove my fix/feature considers common cases that might end in false positives
• In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
• My test use the comment field to write the expected behavior
• I have added documentation for the rule or change (when appropriate)

Further comments

For the reviewer

• Positive and negative tests were added
• Tests cover the intended fix/feature properly
• No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
• In case a regular expression was changed, there is no ReDOS
• Documentation is clear for the rule/change