Proposed changes

956110 is intended to match Ruby ERB templates within response bodies to detect data leakage, however this syntax also overlaps with some common JavaScript templating engines (Zabbix, WordPress, and Horde IMP). I don't see an way to modify this rule to prevent these false positives since the syntax is virtually identical so I'm moving this to level 2.

Closes #4343

PR Checklist

• I have read the CONTRIBUTING doc
• I have added positive tests proving my fix/feature works as intended.
• I have added negative tests that prove my fix/feature considers common cases that might end in false positives
• In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
• My test use the comment field to write the expected behavior
• I have added documentation for the rule or change (when appropriate)

Further comments

N/A

For the reviewer

• Positive and negative tests were added
• Tests cover the intended fix/feature properly
• No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
• In case a regular expression was changed, there is no ReDOS
• Documentation is clear for the rule/change