Core Rule Set: Forgejo's ordinary requests pass by default (closes #342)

Forgejo 17.0.1's recorded requests are in
testdata/forgejo-requests.txt, checked at the defaults.

What Forgejo sends and gitea does not:
- its flash cookie is named flash, which joins gitea_flash among the
  cookies left out;
- its wiki search, whose q skips five rules in forgejo.conf, the
  fifteenth change.

Gaps in gitea's fixes the recording showed: q on the name searches
skips 932250 (ls -la), and the API's package search is one of them.
User and organisation pages, any one-segment path, keep 932250.

Model: opus-5-5

internal/coreruleset/forgejo_test.go

@@ -0,0 +1,78 @@
+package coreruleset_test
+
+import (
+	"net/http"
+	"slices"
+	"testing"
+)
+
+// forgejoSearches are Forgejo's searches whose q skips some rules: the
+// wiki's, from the fifteenth change, and the searches for a name, from the
+// eighth.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var forgejoSearches = []string{
+	"/alice/tools/wiki/search",
+	"/explore/repos",
+	"/explore/users",
+	"/alice/tools/branches",
+	"/alice/-/packages",
+	"/api/v1/packages/alice",
+	"/alice",
+}
+
+// forgejoAttacks are an SQL injection, a path traversal, a script injection
+// and a shell command after a ";", as query values.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var forgejoAttacks = []string{
+	sqlInjection, "..%2Fcustom%2Fconf%2Fapp.ini", scriptInjection, commandInjection,
+}
+
+func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	defaults, bodies := atDefaults(t), readingBodies(t)
+
+	for _, path := range forgejoSearches {
+		for _, attack := range forgejoAttacks {
+			if got := inspect(t, defaults, get(path+"?q="+attack)); got.Score < threshold {
+				t.Errorf("GET %s?q=%s let through: %+v", path, attack, got)
+			}
+
+			// The same field in a form data body.
+			r := request{http.MethodPost, path, []string{formData}}
+			if got, _ := inspectBody(t, bodies, r, "q="+attack); got.Score < threshold {
+				t.Errorf("POST %s q=%s let through: %+v", path, attack, got)
+			}
+		}
+	}
+}
+
+func TestForgejoExclusionsAreNarrow(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := atDefaults(t)
+
+	// /bin/sh and the hard values, which q lets through on the wiki's
+	// search, stay refused in q on paths near it and in another field on it.
+	// /alice/wiki/search would be the code search of a repository named
+	// wiki, where the eighth change lets q through. Forgejo has no owner
+	// named api, so /api/wiki/search is not one.
+	for _, target := range []string{
+		"/alice/tools/wiki/Home?q=",
+		"/alice/tools/wiki/search/x?q=",
+		"/api/wiki/search?q=",
+		"/alice/tools/wiki/search?other=",
+	} {
+		for _, value := range slices.Concat([]string{"%2Fbin%2Fsh"}, hardValues) {
+			if got := inspect(t, crs, get(target+value)); got.Score < threshold {
+				t.Errorf("%s%s let through: %+v", target, value, got)
+			}
+		}
+	}
+}