Describe the bug

Negative test case 941120-8 claims to verify that the rule does not match when the "event handler" name is longer than 50 characters.

The test indeed passes, but not for the correct reason. The rule uses on[a-z]{3,50} which means the word referred to is without the 'on' part. However, the word thisisaverylongwordthathasmorethanfiftycharacters is only 49 characters long.

The actual reason why the test passes is that there's no %3d (translating to equal sign) right after the word.

The following slightly different input will match the rule and fail the negative test:
/get?%20%20onthisisaverylongwordthathasmorethanfiftycharacters%3d%20=vardata

On the other hand, the following input will pass the test even though the word is short:
/get?%20%20onclick%20=vardata

Steps to reproduce

Pass the slightly different input /get?%20%20onthisisaverylongwordthathasmorethanfiftycharacters%3d%20=vardata

Expected behaviour

If the test's claim was true, the test would have passed

Actual behaviour

The test fails (and correctly so because the word is in fact only 49 characters long)

Additional context

To make the test correct, the input should be something like:
/get?%20%20onohthisisaverylongwordthathasmorethanfiftycharacters%3d%20=vardata

Your Environment

I've used https://playground.coraza.io/ to perform tests