changed regexp-942170.data to circumvent regexp-assemble bug

Author: franbuehler

rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf

@@ -133,11 +133,8 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
 #   cd util/regexp-assemble
 #   ./regexp-assemble.pl regexp-942170.data
 # Note that after assemble an outer bracket with an ignore case flag is added
-# and a \ in front of a ? must be removed from the Regexp::Assemble output.
-# Example:
-#   Regexp::Assemble output: (?:select|;)\s+(?:benchmark|sleep|if)\s*?\(\s*?\(\?\s*?\w+
-#   Add ignore case bracket with flag and remove a \ in front of the ?:
-#                        (?i:(?:select|;)\s+(?:benchmark|sleep|if)\s*?\(\s*?\(?\s*?\w+)
+# to the Regexp::Assemble output:
+#   (?i:ASSEMBLE_OUTPUT)
 #
 SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:select|;)\s+(?:benchmark|sleep|if)\s*?\(\s*?\(?\s*?\w+)" \
     "phase:2,\

util/regexp-assemble/regexp-942170.data

@@ -1,6 +1,6 @@
-select\s+benchmark\s*?\(\s*?\(?\s*?\w+
-;\s+benchmark\s*?\(\s*?\(?\s*?\w+
-select\s+if\s*?\(\s*?\(?\s*?\w+
-;\s+if\s*?\(\s*?\(?\s*?\w+
-select\s+sleep\s*?\(\s*?\(?\s*?\w+
-;\s+sleep\s*?\(\s*?\(?\s*?\w+
+select\s+benchmark\s*?\(\s*?[(]?\s*?\w+
+;\s+benchmark\s*?\(\s*?[(]?\s*?\w+
+select\s+if\s*?\(\s*?[(]?\s*?\w+
+;\s+if\s*?\(\s*?[(]?\s*?\w+
+select\s+sleep\s*?\(\s*?[(]?\s*?\w+
+;\s+sleep\s*?\(\s*?[(]?\s*?\w+