Remove everything specific to a Gitea deployment (closes #209)

Delete the Gitea compose setup, its document, its two scripts and their
make targets. Drop the Core Rule Set exclusions written for Gitea: the
ten query parameters skipped by rules 930120, 932160 and 932260, and the
gitea_flash and redirect_to cookies. The remaining changes are
renumbered, five in all. Documents and tests use neutral examples.

Model: opus-5-5

internal/waf/waf_test.go

@@ -118,8 +118,8 @@ func atDefaults(t *testing.T) *waf.CoreRuleSet {
 	return newCoreRuleSet(t, 1, defaultDisabledRules...)
 }
 
-// wantChange checks that crs lets through passes, a gitea request one of
-// the six changes is for, and still finds result in refused, a request
+// wantChange checks that crs lets through passes, a request one of the
+// five changes is for, and still finds result in refused, a request
 // like it that the change is not for.
 func wantChange(
 	t *testing.T, crs *waf.CoreRuleSet, passes, refused request, result waf.Result,
@@ -241,71 +241,25 @@ func TestRedirectURIMayNameALocalAddress(t *testing.T) {
 		get(oauth+"next=http://localhost:52341/"), matched(934110))
 }
 
-func TestParametersGiteaSendsNamesInSkipTheListsOfFilesPathsAndCommands(t *testing.T) {
-	t.Parallel()
-
-	crs := atDefaults(t)
-
-	for _, value := range []struct {
-		name string
-		// result is what a parameter that is not one of gitea's gets.
-		result waf.Result
-	}{
-		// A file on the list of system files.
-		{".gitignore", matched(930120)},
-		// A command's name, after a directory on the list of shell paths.
-		{"bin/docker-entrypoint", matched(932260, 932160)},
-	} {
-		for _, parameter := range []string{
-			"path", "files", "skip-to", "sub_path", "ref", "sha", "branch", "workflow",
-			"artifactName", "redirect_to",
-		} {
-			wantChange(t, crs, get("/?"+parameter+"="+value.name),
-				get("/?q="+value.name), value.result)
-		}
-	}
-
-	// What only those rules refuse gets through there too, but path
-	// traversal and SQL injection are still refused.
-	wantChange(t, crs, get("/?path=|cat%20/etc/passwd"), get("/?q=|cat%20/etc/passwd"),
-		matched(930120, 932160))
-	wantResult(t, crs, get("/?path=../../etc/passwd"),
-		waf.Result{RuleIDs: []int{930100, 930110}, Score: 20})
-	wantResult(t, crs, get("/?path=1'%20OR%20'1'='1"), matched(942100))
-}
-
 func TestParameterNamesAreMatchedWithoutRegardToCase(t *testing.T) {
 	t.Parallel()
 
-	crs := atDefaults(t)
-
-	wantChange(t, crs, get("/?Path=.gitignore"), get("/?q=.gitignore"), matched(930120))
-	wantChange(t, crs, get("/?REDIRECT_URI=http://127.0.0.1:52341/"),
+	wantChange(t, atDefaults(t), get("/?REDIRECT_URI=http://127.0.0.1:52341/"),
 		get("/?next=http://127.0.0.1:52341/"), matched(931100, 934110))
 }
 
-func TestCookiesGiteaFlashAndRedirectToAreNotRead(t *testing.T) {
+func TestCookiesAreRead(t *testing.T) {
 	t.Parallel()
 
-	const (
-		flash      = "success%3DFile%2Bpackage.json%2Bdeleted"
-		redirectTo = "%2Fowner%2Frepo%2Fsrc%2Fbranch%2Fmain%2Fpackage.json"
-	)
+	// A file on the list of system files, in any cookie.
+	const file = "%2Fowner%2Frepo%2Fsrc%2Fbranch%2Fmain%2Fpackage.json"
 
 	crs := atDefaults(t)
 
-	wantChange(t, crs, get("/owner/repo", "Cookie: gitea_flash="+flash),
-		get("/owner/repo", "Cookie: flash="+flash), matched(930120))
-	wantChange(t, crs, get("/", "Cookie: redirect_to="+redirectTo),
-		get("/", "Cookie: redirect="+redirectTo), matched(930120))
-
-	// Among other cookies, which are read.
-	wantChange(t, crs,
-		get("/", "Cookie: lang=en-US; gitea_flash="+flash+"; redirect_to="+redirectTo+
-			"; i_like_gitea=abc"),
-		get("/", "Cookie: lang=en-US; gitea_flash="+flash+"; redirect="+redirectTo+
-			"; i_like_gitea=abc"),
-		matched(930120))
+	for _, name := range []string{"flash", "redirect_to"} {
+		wantResult(t, crs, get("/", "Cookie: lang=en-US; "+name+"="+file),
+			matched(930120))
+	}
 }
 
 func TestRefererIsNotCheckedForACommandOrJavaStartingAProcess(t *testing.T) {
@@ -538,37 +492,32 @@ func TestContentEncodingIsRefusedOnTheKindsOfBodyTheCoreRuleSetReads(t *testing.
 	wantBody(t, atDefaults(t), post(formData, gzip), "a", waf.Result{}, "")
 }
 
-func TestParametersGiteaSendsNamesInAreLeftOutAmongFormFieldsToo(t *testing.T) {
+func TestRedirectURIIsLeftOutAmongFormFieldsToo(t *testing.T) {
 	t.Parallel()
 
+	const local = "http://127.0.0.1:52341/"
+
 	crs := readingBodies(t)
-	local := url.QueryEscape("http://127.0.0.1:52341/")
 
 	for _, tc := range []struct {
-		body string
-		want waf.Result
+		header, body string
+		want         waf.Result
 	}{
-		{"path=.gitignore", waf.Result{}},
-		{"q=.gitignore", matched(930120)},
-		{"redirect_uri=" + local, waf.Result{}},
-		{"next=" + local, matched(931100, 934110)},
+		{formData, "redirect_uri=" + url.QueryEscape(local), waf.Result{}},
+		{formData, "next=" + url.QueryEscape(local), matched(931100, 934110)},
+		{multipart, field("redirect_uri", local) + end, waf.Result{}},
+		{multipart, field("next", local) + end, matched(931100, 934110)},
 	} {
-		wantBody(t, crs, post(formData), tc.body, tc.want, tc.body)
+		wantBody(t, crs, post(tc.header), tc.body, tc.want, tc.body)
 	}
 
-	body := field("path", ".gitignore") + end
-	wantBody(t, crs, post(multipart), body, waf.Result{}, body)
-
-	body = field("q", ".gitignore") + end
-	wantBody(t, crs, post(multipart), body, matched(930120), body)
-
-	// A JSON body's field is named by its path, here json.path, and is
-	// checked.
-	body = `{"path":".gitignore"}`
-	wantBody(t, crs, post(jsonBody), body, matched(930120), body)
+	// A JSON body's field is named by its path, here json.redirect_uri, and
+	// is checked.
+	body := `{"redirect_uri":"` + local + `"}`
+	wantBody(t, crs, post(jsonBody), body, matched(931100, 934110), body)
 }
 
-func TestGiteaBodiesTheCoreRuleSetRefuses(t *testing.T) {
+func TestCommentsAndAttachmentsTheCoreRuleSetRefuses(t *testing.T) {
 	t.Parallel()
 
 	crs := readingBodies(t)