Moved --> keyword from 941180 (PL1) into new stricter sibling rule 941181 (PL2)

[53cur3M3]

Fix for False Positive #2060, at paranoia level 1, caused by matching of "-->".
Moved --> keyword from 941180 (PL1) into new stricter sibling rule 941181 (PL2)

[dune73]

Cool. Thank you for your contribution.

Would you mind creating a test or two for 941181? See the stuff in tests/regression.

Happy to merge afterwards.

[dune73]

@fzipi it looks like lint does not like contains or --> very much. The test failed. Would you mind taking a peek?

[airween]

@fzipi it looks like lint does not like contains or --> very much. The test failed. Would you mind taking a peek?

PR has sent :).

[azurit]

I think you should remove blacklist keyword replacement until issue #2083 is discussed.

[dune73]

In the spirit of keeping things separate, I agree with @azurit that this PR should only do the rules split, now that we have a separate issue and a PR to implement this shift.

[dune73]

Following the merging of secrules_parsing PR 17 we seem to have a new regression with lint on the Webshells response rules.

@airween and @fzipi, could you please check this?

[airween]

Following the merging of secrules_parsing PR 17 we seem to have a new regression with lint on the Webshells response rules.

@airween and @fzipi, could you please check this?

sorry, it's in working progress.

[dune73]

So we're fine with regards to lint again. Thank you for the quick reaction, @airween and @fzipi.

[53cur3M3]

Replaced by pull request 2088