Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352)

Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips
930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and
Forgejo's /admin/ alike, and in the body of the admin forms that adopt a
repository or activate an email. 900605, which lets /bin/sh through in q on
branches and owner packages, now also covers the tags page, a repository's
packages page and the admin packages page, since tag and package names can
hold a slash.

Model: opus-5-5

internal/coreruleset/gitea.conf

@@ -115,26 +115,46 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
     ctl:ruleRemoveTargetById=932260;ARGS:q,\
     ctl:ruleRemoveTargetById=944130;ARGS:q"
 
-# A branch or package name can hold a slash, as feat/docker-support and npm's
-# @scope/name do. So q on a repository's branches page and on an owner's
-# packages page also skips this rule:
+# A branch, tag or package name can hold a slash, as feat/docker-support and
+# npm's @scope/name do. So q on a repository's branches, tags and packages
+# pages, on an owner's packages page and on the admin page of packages also
+# skips this rule:
 #   932160: /bin/sh
-SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/-/packages|[^/]+/[^/]+/branches)$" \
+SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/-/packages|\
+    [^/]+/[^/]+/(?:branches|tags|packages)|(?:-/)?admin/packages)$" \
     "id:900605,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932160;ARGS:q"
 
-# gitea's other searches for a name send it in q too, which skips only these
-# rules there:
-#   930120: .profile
-#   932120: powershell-scripts
+# gitea's other searches send a name or a few words in q too, which skips only
+# these rules there:
+#   930120: .profile, .htaccess
+#   932120: powershell-scripts, powershell
 #   932250: ls -la
-#   932260: python3-app
+#   932260: python3-app, python3
 # The searches:
 #   - the dashboard's filter of repositories;
 #   - the author filter of the issue and pull request lists;
-#   - the lists of users and organisations, and the API's search for users.
-SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|\
+#   - the lists of users and organisations, and the API's search for users;
+#   - the list of repositories a user watches;
+#   - an organisation's issues, pull requests and milestones of one team, and
+#     its search for teams;
+#   - the milestones and projects of a repository, a user or an organisation,
+#     and the issues of one milestone;
+#   - a repository's packages, and the versions of a package;
+#   - the issues suggested when an issue is mentioned;
+#   - the runner lists of the site, a user, an organisation and a repository;
+#   - the admin lists of users, organisations, repositories, unadopted
+#     repositories, emails and packages, and the forms on them that adopt a
+#     repository or activate an email, in the body.
+# gitea serves its admin pages under /-/admin/ and Forgejo under /admin/.
+SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|notifications/watching|\
     explore/(?:users|organizations)|api/v1/users/search|\
-    [^/]+/[^/]+/(?:issues|pulls)/posters)$" \
+    org/[^/]+/(?:(?:issues|pulls|milestones)/[^/]+|teams/-/search)|\
+    [^/]+/-/(?:projects|packages/[^/]+/[^/]+/versions)|\
+    [^/]+/[^/]+/(?:(?:issues|pulls)/posters|issues/suggestions|milestones|\
+    milestone/[0-9]+|projects|packages|settings/actions/runners)|\
+    user/settings/actions/runners|\
+    (?:-/)?admin/(?:users|orgs|repos|repos/unadopted|emails|emails/activate|\
+    packages|actions/runners))$" \
     "id:900603,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=930120;ARGS:q,\
     ctl:ruleRemoveTargetById=932120;ARGS:q,\