Description

Would like to take a stab at converting some of these (before the LTS).

summary

36 rules in REQUEST-*.conf files have @rx patterns over 50 characters with no corresponding .ra file:

• refactor: create rule 931100 and 931110 .ra files #4489
• refactor: create 933140 and 933180 .ra files #4488
• refactor: create 944300 .ra file #4490
• refactor: create 934130 .ra file #4487
• refactor: create 941320 .ra file #4491
• refactor: create 941330 .ra file #4492
• refactor: create 941170 .ra file #4493
• feat: move 930110 to regex-assembly #4494
• refactor: create 921110 .ra file #4495
• refactor: create 921120 .ra file #4496
• refactor: create 921160 .ra file #4497
• refactor: create 941120 .ra file #4498
• feat: move 943100 to regex-assembly #4504
• refactor: create 944120 .ra file #4508
• refactor: create 944240 .ra file #4509
• refactor: create 944260 .ra file #4510
• refactor: create 942220 .ra file #4511
• refactor: create 942250 .ra file #4512
• refactor: create 942450 .ra file #4513
• refactor: create 942510 and 942511 .ra files with shared include #4516
• refactor: create 941400 .ra file #4517
• refactor: create 941370 .ra file #4518
• refactor: create 941250 .ra file #4520
• refactor: create 941300 .ra file #4521
• refactor: create 941310 .ra files #4522

Top candidates for .ra conversion (by regex length):

1. ✅ 944300 — 721 chars (base64-encoded Java gadget detection)
2. ✅ 941320 — 652 chars (HTML tag enumeration)
3. ✅ 941330 — 439 chars (JS obfuscation patterns)

The XSS (941xxx) and SQLi (942xxx) families dominate with 10 rules each. The 942420-432 family (5 rules) shares the same pattern structure so they'd benefit from a shared .ra include file. Similarly, 943110/943120 and 944120/944240 are near-duplicate pairs.