Fix FP in 941130 and rearrange regex with new regex-assemble file

rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf

@@ -126,7 +126,12 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H
 #
 # -=[ XSS Filters - Category 3 ]=-
 #
-SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\s\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\/html|formaction|\@import|base64)\b|pattern\b.*?=)" \
+# Regexp generated from util/regexp-assemble/regexp-941130.data using Regexp::Assemble.
+# To rebuild the regexp:
+#   cd util/regexp-assemble
+#   ./regexp-assemble.pl regexp-941130.data
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\s\S](?:!ENTITY.*?(?:PUBLIC|SYSTEM)|x(?:link:href|html|mlns)|data:text\/html|pattern\b.*?=|formaction|\@import|;base64)\b" \
     "id:941130,\
     phase:2,\
     block,\

util/regexp-assemble/regexp-941130.data

@@ -0,0 +1,10 @@
+(?i)[\s\S]xlink:href\b
+(?i)[\s\S]xhtml\b
+(?i)[\s\S]xmlns\b
+(?i)[\s\S]!ENTITY.*?SYSTEM\b
+(?i)[\s\S]!ENTITY.*?PUBLIC\b
+(?i)[\s\S]data:text/html\b
+(?i)[\s\S]formaction\b
+(?i)[\s\S]@import\b
+(?i)[\s\S];base64\b
+(?i)[\s\S]pattern\b.*?=\b