OWASP CRS MoD security false positive - rule 942150 "@contains"

Question

Can someone help with the below,

SecRule REQUEST_FILENAME "@streq template.html" \
    "id:9999001,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    chain"
    SecRule REQUEST_METHOD "@streq GET" \
        "chain"
        SecRule ARGS:q "@contains cos" \
            "t:none,\
            ctl:ruleRemoveTargetById=942150;ARGS:q"

I need to add the another string to @containts as example "@contains cos, user, name". Please suggest with the right syntax for declaring "contains" with multiple values

Answer 1

@contains can't handle multiple words, as it stated in the documentation.

You can use @rx instead, eg:

...
        "chain"
        SecRule ARGS:q "@rx (cos|user|name)" \
            "t:none,\
            ctl:ruleRemoveTargetById=942150;ARGS:q"

or you can extend this regular expression as you want, eg. @rx ^(cos|...).