Core Rule Set: ls -la passes in q on a gitea user's or organisation's page (closes #349)

On a path of one segment, q now skips 932250 too, unless the path ends
in .php, as /index.php does. The Forgejo recording gains the two
searches for ls -la, made from the recorded searches for python3.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -1063,6 +1063,41 @@ func TestGiteaAttacksAreRefused(t *testing.T) {
 	}
 }
 
+func TestGiteaSearchOnAUsersOrAnOrganisationsPageLetsLsThrough(t *testing.T) {
+	t.Parallel()
+
+	crs := atDefaults(t)
+
+	// The searches of a user's and of an organisation's repositories.
+	for _, target := range []string{
+		"/alice?tab=repositories&q=ls%20-la",
+		"/acme?q=ls%20-la&sort=recentupdate",
+		"/jane.doe?tab=repositories&q=ls%20-la",
+	} {
+		wantResult(t, crs, get(target), coreruleset.Result{})
+	}
+
+	// A path that ends in .php, another field, and a path of two segments
+	// keep 932250.
+	for _, target := range []string{
+		"/index.php?q=ls%20-la",
+		"/INDEX.PHP?q=ls%20-la",
+		"/index%2Ephp?q=ls%20-la",
+		"/alice?tab=ls%20-la",
+		"/alice/tools?q=ls%20-la",
+	} {
+		wantResult(t, crs, get(target), matched(932250))
+	}
+
+	// A command after a ";" is still refused on those pages.
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	target := "/alice?tab=repositories&q=" + commandInjection
+	if got := inspect(t, crs, get(target)); got.Score < threshold {
+		t.Errorf("%s let through: %+v", target, got)
+	}
+}
+
 // WordPress's paths: signing in, posting a comment, admin-ajax.php, and the
 // REST API routes of a post and of the tags.
 const (