Repository: coreruleset/coreruleset

Issue:
Google link/crawler blocked at PL2
### Description
Hello everyone,

Here is another false positive found in our production.
The `ARGS:gclid` contains a token in URL when someone visits a website by clicking a shared link on google/youtube.
However, it matches the following rules:

942440 PL2 SQL Comment Sequence Detected
949110 PL1 Inbound Anomaly Score Exceeded (Total Score: 5)
980170 PL1 Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=0-5-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=5, XSS=0, RFI=0, LFI=0, RCE=0, PHPI=0, HTTP=0, SESS=0)

Example:
`example.com/file/?gclid=j0KCQiA1NebBhDDARIsAANiDD3_RJeMv8zScF--mC1jf8fO8PDYJCxD9xdwT7iQ59QIIwL-86ncQtMaAh0lEALw_wcB`

Test on sandbox:
`curl -s -H "x-format-output: txt-matched-rules" -H 'x-crs-paranoia-level: 2' 'https://sandbox.coreruleset.org/file/?gclid=Cj0KCQiA1NebBhDDARIsAANiDD3_RJeMv8zScF--mC1jf8fO8PDYJCxD9xdwT7iQ59QIIwL-86ncQtMaAh0lEALw_wcB'`

We excluded following way:
```
SecRule &ARGS:gclid "@gt 0" "id:xxxxxxxx,\
    ....,\
    ....,\
    ctl:ruleRemoveTargetById=942440;ARGS:gclid,\
    chain"
    SecRule ARGS:gclid "@rx ^[a-zA-Z0-9_-]{0,100}$" "t:none"

```
### Confirmation

- [x] I have removed any personal data (email addresses, IP addresses,
    passwords, domain names) from any logs posted.

Thanks as always, @theMiddleBlue 



Discussion:
issue related to #2981 
same rule (942440)
Can we close this one? Is there something to solve?
This issue is not resolved so don't close it but plz resolve it
@skrlance That was an internal comment, meaning we need to take action. You are also invited to participate in solving this, btw.

Resolving patch:
diff --git a/util/find-rules-without-test/find-rules-without-test.py b/util/find-rules-without-test/find-rules-without-test.py
--- a/util/find-rules-without-test/find-rules-without-test.py
+++ b/util/find-rules-without-test/find-rules-without-test.py
@@ -23,7 +23,7 @@
 import msc_pyparser
 import argparse
 
-EXCLUSION_LIST = ["900", "901", "905", "910", "912", "949", "921170"]
+EXCLUSION_LIST = ["900", "901", "905", "910", "912", "949", "921170", "942441", "942442"]
 oformat = "native"
 
 def find_ids(s, test_cases):


Test patch:
diff --git a/tests/regression/tests/REQUEST-942-APPLICATION-ATTACK-SQLI/942440.yaml b/tests/regression/tests/REQUEST-942-APPLICATION-ATTACK-SQLI/942440.yaml
--- a/tests/regression/tests/REQUEST-942-APPLICATION-ATTACK-SQLI/942440.yaml
+++ b/tests/regression/tests/REQUEST-942-APPLICATION-ATTACK-SQLI/942440.yaml
@@ -1,6 +1,6 @@
 ---
 meta:
-  author: "Christian S.J. Peron"
+  author: "Christian S.J. Peron, Max Leske"
   description: None
   enabled: true
   name: 942440.yaml
@@ -307,3 +307,33 @@ tests:
             uri: "/callback?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMe--KKF2QT4fwpMeJf36POk6yJV_adQssw-5c"
           output:
             no_log_contains: id "942440"
+  - test_title: 942440-19
+    desc: "False positive against Facebook click identifier"
+    stages:
+      - stage:
+          input:
+            dest_addr: 127.0.0.1
+            headers:
+              Host: localhost
+              User-Agent: "OWASP CRS test agent"
+            method: "GET"
+            port: 80
+            version: "HTTP/1.1"
+            uri: "/get/?fbclid=IwAR1dug0BYxe0ukhZ2vKrdQwLAxVFRJ--Q2Y7OBJE_0uId9-Eh-sJWLdVk2E"
+          output:
+            no_log_contains: id "942440"
+  - test_title: 942440-20
+    desc: "False positive against Google click identifier"
+    stages:
+      - stage:
+          input:
+            dest_addr: 127.0.0.1
+            headers:
+              Host: localhost
+              User-Agent: "OWASP CRS test agent"
+            method: "GET"
+            port: 80
+            version: "HTTP/1.1"
+            uri: "/get/?gclid=j0KCQiA1NebBhDDARIsAANiDD3_RJeMv8zScF--mC1jf8fO8PDYJCxD9xdwT7iQ59QIIwL-86ncQtMaAh0lEALw_wcB"
+          output:
+            no_log_contains: id "942440"