File: //usr/local/modsecurity-crs/regex-assembly/941220.ra
##! Please refer to the documentation at
##! https://coreruleset.org/docs/development/regex_assembly/.
##! This rule tries to match all the possible ways to write 'vbscript' using
##! html entities, and javascript escape sequences.
##! See https://html.spec.whatwg.org/multipage/named-characters.html#named-character-references for examples.
##! And https://www.w3schools.com/charsets/ref_html_ascii.asp for the list of
##! all the possible html entities.
##!+ i
##! Matched order is sequential: we first match 'v', then 'b', then 's', etc.
##!> define html_entity_hex_prefix �*
##!> define html_entity_dec_prefix �*
##!> define whitespaces [\t\n\r]
##! html_encoded_whitespace is a list of all the possible ways to write an encoded whitespace
##!> assemble
##! canonical form
{{whitespaces}}
##! alternative forms
##!> assemble
##! 09 horizontal tab
##! 10 line feed
##! 13 carriage return
##! 0A line feed (hex)
##! 0D carriage return (hex)
{{html_entity_dec_prefix}}9;?
{{html_entity_dec_prefix}}10;?
{{html_entity_dec_prefix}}13;?
{{html_entity_hex_prefix}}A;?
{{html_entity_hex_prefix}}D;?
&tab;
&newline;
##!=>
##!<
##!=>
*
##!=< html_encoded_whitespace
##!<
##! all the possible ways to end the word 'vbscript', plus whitespaces
##!> assemble
##! canonical form
:
##! alternative forms
##!> assemble
##! 58 : colon
##! 3A : colon (hex)
{{html_entity_dec_prefix}}58;?
{{html_entity_hex_prefix}}3A;?
:
##!<
##!=>
.
##!=< end_vbscript
##!<
##!=>
##! all the possible ways to write 'v', plus whitespaces
##! canonical form
v
##! alternative forms
##!> assemble
##! v 118 lowercase v
##! v 76 lowercase v (hex)
##! V 86 uppercase V
##! V 56 uppercase V (hex)
{{html_entity_dec_prefix}}118;
{{html_entity_hex_prefix}}76;
{{html_entity_dec_prefix}}86;
{{html_entity_hex_prefix}}56;
##!<
##!=>
##!=> html_encoded_whitespace
##!=>
##! all the possible ways to write 'b', plus whitespaces
##! canonical form
b
##! alternative forms
##!> assemble
##! b 98 lowercase b
##! b 62 lowercase b (hex)
##! B 66 uppercase B
##! B 42 uppercase B (hex)
{{html_entity_dec_prefix}}98;
{{html_entity_hex_prefix}}62;
{{html_entity_dec_prefix}}66;
{{html_entity_hex_prefix}}42;
##!<
##!=>
##!=> html_encoded_whitespace
##!=>
##! all the possible ways to write 's', plus whitespaces
##! canonical form
s
##! alternative forms
##!> assemble
##! s 115 lowercase s
##! s 73 lowercase s (hex)
##! S 83 uppercase S
##! S 53 uppercase S (hex)
{{html_entity_dec_prefix}}115;
{{html_entity_hex_prefix}}73;
{{html_entity_dec_prefix}}83;
{{html_entity_hex_prefix}}53;
##!<
##!=>
##!=> html_encoded_whitespace
##!=>
##! all the possible ways to write 'c', plus whitespaces
##! canonical form
c
##! alternative forms
##!> assemble
##! c 63 lowercase C (hex)
##! c 99 lowercase c
##! C 43 uppercase c (hex)
##! C 67 uppercase C
{{html_entity_hex_prefix}}63;
{{html_entity_dec_prefix}}99;
{{html_entity_hex_prefix}}43;
{{html_entity_dec_prefix}}67;
##!<
##!=>
##!=> html_encoded_whitespace
##!=>
##! all the possible ways to write 'r', plus whitespaces
##! canonical form
r
##! alternative forms
##!> assemble
##! r 72 lowercase R (hex)
##! r 114 lowercase r
##! r 52 uppercase r (hex)
##! R 82 uppercase R
{{html_entity_hex_prefix}}72;
{{html_entity_dec_prefix}}114;
{{html_entity_hex_prefix}}52;
{{html_entity_dec_prefix}}82;
##!<
##!=>
##!=> html_encoded_whitespace
##!=>
##! all the possible ways to write 'i', plus whitespaces
##! canonical form
i
##! alternative forms
##!> assemble
##! i 69 lowercase i (hex)
##! i 105 lowercase i
##! I 49 uppercase i (hex)
##! I 73 uppercase I
{{html_entity_hex_prefix}}69;
{{html_entity_dec_prefix}}105;
{{html_entity_hex_prefix}}49;
{{html_entity_dec_prefix}}73;
##!<
##!=>
##!=> html_encoded_whitespace
##!=>
##! all the possible ways to write 'p', plus whitespaces
##! canonical form
p
##! alternative forms
##!> assemble
##! p 70 lowercase p (hex)
##! p 112 lowercase p
##! P 50 uppercase p (hex)
##! P 80 uppercase P
{{html_entity_hex_prefix}}70;
{{html_entity_dec_prefix}}112;
{{html_entity_hex_prefix}}50;
{{html_entity_dec_prefix}}80;
##!<
##!=>
##!=> html_encoded_whitespace
##!=>
##! all the possible ways to write 't', plus whitespaces
##! canonical form
t
##! alternative forms
##!> assemble
##! t 74 lowercase t (hex)
##! t 116 lowercase t
##! T 54 uppercase t (hex)
##! T 84 uppercase T
{{html_entity_hex_prefix}}74;
{{html_entity_dec_prefix}}116;
{{html_entity_hex_prefix}}54;
{{html_entity_dec_prefix}}84;
##!<
##!=>
##!=> html_encoded_whitespace
##!=>
##!=> end_vbscript