From 3d9e3976b008619a9f24945095b9779ab6b0354a Mon Sep 17 00:00:00 2001 From: clawbot <35+clawbot@noreply.example.org> Date: Tue, 10 Nov 2026 04:26:08 +0100 Subject: [PATCH] Core Rule Set: gitea's search Referer exclusion skips /api/v2/search (closes #270) Rule 900601 let Referer skip five rules when it named a repository's search, issues or pull requests with the owner api, such as /api/v2/search, Mastodon's search. A page opened from there skipped script and SQL injection checks on Referer. gitea has no owner named api, so a chained condition now leaves out those paths, as rule 900600 does. Model: opus-5-5 --- internal/coreruleset/coreruleset_test.go | 8 ++++++++ internal/coreruleset/gitea.conf | 15 +++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/internal/coreruleset/coreruleset_test.go b/internal/coreruleset/coreruleset_test.go index 241a80d..1973cee 100644 --- a/internal/coreruleset/coreruleset_test.go +++ b/internal/coreruleset/coreruleset_test.go @@ -692,6 +692,14 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) { t.Errorf("%s let through: %+v", target, got) } } + + // Nor is a page opened from them. + for _, attack := range []string{scriptTag, injection} { + referer := "Referer: https://example.com" + path + "?q=" + attack + if got := inspect(t, crs, get("/", referer)); got.Score < threshold { + t.Errorf("%s let through: %+v", referer, got) + } + } } } diff --git a/internal/coreruleset/gitea.conf b/internal/coreruleset/gitea.conf index 2736fbe..6059b24 100644 --- a/internal/coreruleset/gitea.conf +++ b/internal/coreruleset/gitea.conf @@ -83,17 +83,20 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\ # 941160: