Proposed changes

Hello,

Since the rule already inspects REQUEST_COOKIES, there is no need to analyze them a second time. Therefore, we exclude the Cookie header from the set of inspected headers.

Impact on rules : 944110,944120,944130,944150,944151,944200,944210,944240,944250,944260,944300,944152

PR Checklist

• I have read the CONTRIBUTING doc
• I have added positive tests proving my fix/feature works as intended.
• I have added negative tests that prove my fix/feature considers common cases that might end in false positives
• In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
• My test use the comment field to write the expected behavior
• I have added documentation for the rule or change (when appropriate)

Further comments

For the reviewer

• Positive and negative tests were added
• Tests cover the intended fix/feature properly
• No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
• In case a regular expression was changed, there is no ReDOS
• Documentation is clear for the rule/change