fix: fp regression in carddav (#95)

plugins/nextcloud-rule-exclusions-before.conf

@@ -1698,7 +1698,7 @@ SecRule REQUEST_FILENAME "@rx /apps/privacy/api/admins/[0-9]+$" \
 # Administration Settings --> Overview
 # Fix false positives with "Security and setup warnings" tests
 # Allow DAV clients to scan for dav endpoints
-SecRule REQUEST_FILENAME "@rx /\.well-known/(?:cal|car|web)dav" \
+SecRule REQUEST_FILENAME "@rx /\.well-known/(?:cal|card|web)dav" \
     "id:9508641,\
     phase:1,\
     pass,\

tests/regression/nextcloud-rule-exclusions-plugin/9508641.yaml

@@ -0,0 +1,52 @@
+---
+meta:
+  author: "Esad Cetiner"
+  description: "Nextcloud Administration Settings: Testing Caldav/Cardav/Webdav functionality"
+  enabled: true
+  name: 9508641.yaml
+tests:
+  - test_title: 9508641-1
+    stages:
+      - stage:
+          input:
+            dest_addr: 127.0.0.1
+            headers:
+              Host: localhost
+              User-Agent: OWASP CRS test agent
+              Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+            port: 80
+            method: PROPFIND
+            uri: /.well-known/carddav
+            version: HTTP/1.1
+          output:
+            no_log_contains: id "911100"
+  - test_title: 9508641-2
+    stages:
+      - stage:
+          input:
+            dest_addr: 127.0.0.1
+            headers:
+              Host: localhost
+              User-Agent: OWASP CRS test agent
+              Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+            port: 80
+            method: PROPFIND
+            uri: /.well-known/caldav
+            version: HTTP/1.1
+          output:
+            no_log_contains: id "911100"
+  - test_title: 9508641-3
+    stages:
+      - stage:
+          input:
+            dest_addr: 127.0.0.1
+            headers:
+              Host: localhost
+              User-Agent: OWASP CRS test agent
+              Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+            port: 80
+            method: PROPFIND
+            uri: /.well-known/webdav
+            version: HTTP/1.1
+          output:
+            no_log_contains: id "911100"