template syntax fixes (#4711)

cves/2017/CVE-2017-7269.yaml

@@ -31,7 +31,6 @@ requests:
           - "IIS/6.0"
 
       - type: dsl
-        part: header
         dsl:
           - regex("<DAV:sql>", dasl)    # lowercase header name: DASL
           - regex("[\d]+(,\s+[\d]+)?", dav)    # lowercase header name: DAV
@@ -42,4 +41,5 @@ requests:
       - type: status
         status:
           - 200
+
 # Enhanced by mp on 2022/05/11

cves/2020/CVE-2020-11547.yaml

@@ -27,13 +27,12 @@ requests:
     matchers:
       - type: dsl
         dsl:
-          - "contains((body_1), 'Probe #1') && contains((body_2), '<span>Configuration Requests Sent</span>')"
-        part: body
+          - "contains(body_1, 'Probe #1') && contains(body_2, '<span>Configuration Requests Sent</span>')"
 
       - type: word
+        part: body
         words:
           - "prtg_network_monitor"
-        part: body
 
       - type: status
         status:

cves/2022/CVE-2022-24681.yaml

@@ -36,7 +36,6 @@ requests:
     matchers-condition: and
     matchers:
       - type: dsl
-        part: body
         dsl:
           - compare_versions(buildnumber, '< 6121')
 

exposures/configs/javascript-env.yaml

@@ -25,7 +25,6 @@ requests:
           - 200
 
       - type: dsl
-        part: header
         dsl:
           - "contains(tolower(all_headers), 'content-type: application/javascript')"
 
@@ -49,5 +48,5 @@ requests:
           - "Bootstrap"
           - "jQuery"
           - "CSS TRANSITION SUPPORT"
-        negative: true
         condition: or
+        negative: true

technologies/aws/aws-bucket-service.yaml

@@ -19,11 +19,9 @@ requests:
           - contains(tolower(all_headers), 'x-amz-request')
           - contains(tolower(all_headers), 'x-amz-id')
           - contains(tolower(all_headers), 'amazons3')
-        part: header
         condition: or
 
       - type: dsl
         dsl:
           - contains(tolower(all_headers), 'x-guploader-uploadid')
-        part: header
         negative: true

technologies/google/google-bucket-service.yaml

@@ -21,5 +21,4 @@ requests:
           - contains(tolower(all_headers), 'x-goog-stored-content-encoding')
           - contains(tolower(all_headers), 'x-goog-stored-content-length')
           - contains(tolower(all_headers), 'x-guploader-uploadid')
-        part: header
         condition: or

vulnerabilities/cisco/cucm-username-enumeration.yaml

@@ -28,7 +28,6 @@ requests:
         condition: and
 
       - type: dsl
-        part: header
         dsl:
           - contains(tolower(content_type), 'application/xml')
           - contains(tolower(content_type), 'text/xml')

vulnerabilities/other/qihang-media-lfi.yaml

@@ -24,14 +24,14 @@ requests:
     matchers-condition: and
     matchers:
       - type: word
+        part: header
         words:
           - "filename=QH.aspx"
           - "application/zip"
-        part: header
         condition: and
 
       - type: word
-        regex:
+        words:
           - "QH.aspx.cs"
           - "QiHang.Media.Web.QH"
         condition: and