Suricata

I test the transformation keyword url_decode by writing 2 rules. And I get an alert by only using rule2.
However, if I using rule1 and rule2 together, then no alert occurs.

rule1:
alert http any any -> $HOME_NET any (msg:"detecting (/etc/passwd)"; flow:to_server,established; http.request_body; content:"\\\etc\\\passwd")

rule2:
alert http any any -> $HOME_NET any (msg:"detecting (/etc/passwd)"; flow:to_server,established; http.request_body; url_decode; content:"\\\etc\\\passwd")

I debug the detection part of the code and figuring out the workflow of transformation. If a rule file containing rule1 detecting a sticky buffer and rule2 detecting the sticky buffer after transformation, Suricata starts from inepecting the original sticky buffer. After this process, the sticky buffer would be flagged as "already inspected". So transformation can't be performed on this sticky buffer since it's already taken and inspected. Therefore, rule2 can't trigger any alert.

I wonder, if it's a BUG of transformation. I can't find any other useful information through the [documentation](https://suricata.readthedocs.io/en/suricata-6.0.0/rules/transforms.h).