Core Rule Set: a repository's name passes in the adopt form's id (closes #365)

While bodies are read, the admin forms that adopt or delete an unadopted
repository were refused when the repository's name held a command or a
system file's name, such as alice/python3-app, alice/powershell-scripts or
alice/.profile. id there now skips 930120, 932120 and 932260, on gitea's
/-/admin/repos/unadopted and Forgejo's /admin/repos/unadopted.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -2421,6 +2421,51 @@ func TestGiteaBodiesTheCoreRuleSetRefuses(t *testing.T) {
 	)
 }
 
+func TestGiteaFormsThatAdoptARepositoryLetItsNameThrough(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := readingBodies(t)
+
+	// gitea's path, then Forgejo's.
+	for _, path := range []string{
+		"/-/admin/repos/unadopted",
+		"/admin/repos/unadopted",
+	} {
+		r := request{http.MethodPost, path, []string{formData}}
+
+		for _, action := range []string{"adopt", "delete"} {
+			for _, name := range []string{
+				"alice%2Fpython3-app",
+				"alice%2Fpowershell-scripts",
+				"alice%2F.profile",
+			} {
+				body := "id=" + name + "&action=" + action + "&q=&page=1"
+				wantBody(t, crs, r, body, coreruleset.Result{}, body)
+			}
+		}
+
+		// Attacks in id are still refused.
+		for _, attack := range []string{
+			sqlInjection,
+			scriptInjection,
+			commandInjection,
+			"..%2F..%2Fetc%2Fpasswd",
+		} {
+			body := "id=" + attack + "&action=adopt&q=&page=1"
+			if got, _ := inspectBody(t, crs, r, body); got.Score < threshold {
+				t.Errorf("POST %s %s let through: %+v", path, body, got)
+			}
+		}
+	}
+
+	// On another path, id keeps those rules.
+	r := request{http.MethodPost, "/-/admin/repos", []string{formData}}
+	body := "id=alice%2Fpython3-app&action=adopt&q=&page=1"
+	wantBody(t, crs, r, body, matched(932260), body)
+}
+
 func TestTypesEndingInXMLOrJSONAndTextJSONAreRead(t *testing.T) {
 	t.Parallel()