#CF WAF rule bug