Remove everything specific to a Gitea deployment (closes #209)

Delete the Gitea compose setup, its document, its two scripts and their
make targets. Drop the Core Rule Set exclusions written for Gitea: the
ten query parameters skipped by rules 930120, 932160 and 932260, and the
gitea_flash and redirect_to cookies. The remaining changes are
renumbered, five in all. Documents and tests use neutral examples.

Model: opus-5-5

internal/waf/waf.go

@@ -1,6 +1,6 @@
 // Package waf runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWWAF_WAF_BODY_LIMIT is set, with the six changes smallwebwaf
+// body while SWWAF_WAF_BODY_LIMIT is set, with the five changes smallwebwaf
 // makes to it, as "Attack detection" under "Settings" in SPEC.md describes
 // them. It reads no response.
 //
@@ -15,7 +15,6 @@ import (
 	"io"
 	"net/http"
 	"net/netip"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -69,35 +68,19 @@ SecArgumentsLimit 1000
 SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
     severity:'CRITICAL',setvar:'tx.inbound_anomaly_score_pl1=+5'"
 
-# The sixth: only the rules for requests are loaded, and no response is
+# The fifth: only the rules for requests are loaded, and no response is
 # inspected.
 Include @owasp_crs/REQUEST-*.conf
 
 # The third: redirect_uri is not checked for a URL naming an IP address or
-# localhost. Coraza matches a parameter name here, and in the fourth,
-# without regard to case. ARGS holds the fields of a form data or multipart
-# body Coraza reads as well as the query parameters, so a field of one of
-# these names is left out too.
+# localhost. Coraza matches a parameter name without regard to case. ARGS
+# holds the fields of a form data or multipart body Coraza reads as well as
+# the query parameters, so a field of this name is left out too.
 SecRuleUpdateTargetById 931100 "!ARGS:redirect_uri"
 SecRuleUpdateTargetById 934110 "!ARGS:redirect_uri"
 
-# The fourth: the query parameters in which gitea sends names within a
-# repository or its own records, or a page of its own site, are not
-# checked against the lists of system files, shell paths and command
-# names. Coraza takes one rule id per directive.
-SecRuleUpdateTargetById 930120 "!ARGS:path|!ARGS:files|!ARGS:skip-to|\
-    !ARGS:sub_path|!ARGS:ref|!ARGS:sha|!ARGS:branch|!ARGS:workflow|\
-    !ARGS:artifactName|!ARGS:redirect_to"
-SecRuleUpdateTargetById 932160 "!ARGS:path|!ARGS:files|!ARGS:skip-to|\
-    !ARGS:sub_path|!ARGS:ref|!ARGS:sha|!ARGS:branch|!ARGS:workflow|\
-    !ARGS:artifactName|!ARGS:redirect_to"
-SecRuleUpdateTargetById 932260 "!ARGS:path|!ARGS:files|!ARGS:skip-to|\
-    !ARGS:sub_path|!ARGS:ref|!ARGS:sha|!ARGS:branch|!ARGS:workflow|\
-    !ARGS:artifactName|!ARGS:redirect_to"
-
-# The fifth, for Referer: it is not checked for a Unix command without
-# arguments, or for Java starting a process. The cookies are left out in
-# Inspect.
+# The fourth: Referer is not checked for a Unix command without arguments,
+# or for Java starting a process. Coraza takes one rule id per directive.
 SecRuleUpdateTargetById 932340 "!REQUEST_HEADERS:Referer"
 SecRuleUpdateTargetById 944110 "!REQUEST_HEADERS:Referer"
 `
@@ -144,12 +127,6 @@ SecRule MULTIPART_STRICT_ERROR "!@eq 0" "id:900450,phase:2,pass,\
     severity:'CRITICAL',setvar:'tx.inbound_anomaly_score_pl1=+5'"
 `
 
-// cookiesNotRead are the cookies the Core Rule Set reads a request
-// without, the rest of the fifth change.
-//
-//nolint:gochecknoglobals // a constant cannot be a list
-var cookiesNotRead = []string{"gitea_flash", "redirect_to"}
-
 // Params are what New needs.
 type Params struct {
 	// ParanoiaLevel is SWWAF_WAF_PARANOIA_LEVEL, from 1 to 4.
@@ -169,7 +146,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the six changes, at params'
+// New returns the Core Rule Set with the five changes, at params'
 // paranoia level, without the rules it switches off, and reading request
 // bodies up to params' limit.
 func New(params Params) (*CoreRuleSet, error) {
@@ -209,10 +186,10 @@ type Result struct {
 }
 
 // Inspect runs the Core Rule Set on r, a request from client: on its
-// method, its URL with the query, and its headers, the Cookie header
-// without the cookies in cookiesNotRead, and on body, r's body as the
-// caller has it, as readBody reads it. It returns what it found, what it
-// read of body, and the error that ended the reading early, if one did.
+// method, its URL with the query, and its headers, and on body, r's body
+// as the caller has it, as readBody reads it. It returns what it found,
+// what it read of body, and the error that ended the reading early, if
+// one did.
 func (c *CoreRuleSet) Inspect(
 	r *http.Request, client netip.Addr, body io.Reader,
 ) (Result, []byte, error) {
@@ -225,13 +202,6 @@ func (c *CoreRuleSet) Inspect(
 
 	for name, values := range r.Header {
 		for _, value := range values {
-			if name == "Cookie" {
-				value = withoutCookiesNotRead(value)
-				if value == "" {
-					continue // it held those cookies alone
-				}
-			}
-
 			tx.AddRequestHeader(name, value)
 		}
 	}
@@ -318,18 +288,3 @@ func score(tx types.Transaction) int {
 
 	return n
 }
-
-// withoutCookiesNotRead returns value, a Cookie header's, without the
-// cookies in cookiesNotRead.
-func withoutCookiesNotRead(value string) string {
-	var kept []string
-
-	for cookie := range strings.SplitSeq(value, ";") {
-		name, _, _ := strings.Cut(strings.TrimSpace(cookie), "=")
-		if !slices.Contains(cookiesNotRead, name) {
-			kept = append(kept, cookie)
-		}
-	}
-
-	return strings.Join(kept, ";")
-}