Core Rule Set: WordPress's names and addresses pass on more fields (closes #245)

The four rules on system files and commands (930120, 932120, 932250,
932260) now skip:

- page, p, postId and slug on all of wp-admin;
- url on the block editor's link previews and embeds: the REST group
  now covers /wp-block-editor/v1/ and /oembed/1.0/;
- the JSON fields title, excerpt, slug and name on /wp/v2/ routes.

A commenter's url skips 930120 and 932120 only. Every field keeps 932235.
Add 61 requests recorded from WordPress 7.1.4 with these fields.

Model: opus-5-5

internal/coreruleset/wordpress.conf

@@ -102,6 +102,29 @@ SecRule REQUEST_FILENAME "@streq /wp-login.php" \
     "id:900704,phase:1,pass,nolog,chain"
     SecRule &ARGS_GET:pwd "@eq 0" "ctl:ruleRemoveTargetById=930120;ARGS:pwd"
 
+# Saving through the REST API, a post's title, excerpt and slug and a tag's name
+# skip these rules in the JSON fields title, excerpt, slug and name:
+#   930120: .htaccess
+#   932120: powershell
+#   932250: ls -la
+#   932260: python3
+SecRule TX:rest_route "@beginsWith /wp/v2/" "id:900712,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:title|excerpt|slug|name)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:title|excerpt|slug|name)$/,\
+        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:title|excerpt|slug|name)$/,\
+        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:title|excerpt|slug|name)$/,\
+        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:title|excerpt|slug|name)$/"
+
+# A comment's author gives the address of their site in url, which skips these
+# rules there:
+#   930120: http://blog.example/.htaccess
+#   932120: http://blog.example/powershell-basics/
+SecRule REQUEST_FILENAME "@streq /wp-comments-post.php" \
+    "id:900713,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:url "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:url,\
+        ctl:ruleRemoveTargetById=932120;ARGS:url"
+
 # The plugin and theme file editors name the file open in file, which skips
 # these rules there:
 #   930120: akismet/views/config.php
@@ -117,9 +140,9 @@ SecRule REQUEST_FILENAME "@rx ^/wp-admin/(?:plugin|theme)-editor\.php$" \
     ctl:ruleRemoveTargetById=932260;ARGS:file,\
     ctl:ruleRemoveTargetById=941180;ARGS:file"
 
-# Searches, the names of tags, categories, plugins and themes, and WordPress's
-# addresses for its own pages can hold any word. In the fields of the next three
-# rules, each request skips the rules that refused such words:
+# Searches, the names of tags, categories, plugins, themes, templates and
+# plugins' settings pages, and addresses can hold any word. In the fields of the
+# next three rules, each request skips the rules that refused such words:
 #   930120: .htaccess
 #   932120: powershell
 #   932250: ls -la
@@ -128,18 +151,20 @@ SecRule REQUEST_FILENAME "@rx ^/wp-admin/(?:plugin|theme)-editor\.php$" \
 # group also skip:
 #   932235: python3, in the address of a page of results
 
-# All of wp-admin, and signing in.
+# All of wp-admin, and signing in. A plugin's settings page is named in page,
+# a template in p and postId of the site editor, and a plugin to install in
+# slug. Names are matched in lower case, so postId is written postid.
 SecRule REQUEST_FILENAME "@rx ^/(?:wp-admin/|wp-login\.php$)" \
     "id:900707,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930120;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
-    ctl:ruleRemoveTargetById=932120;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
+    ctl:ruleRemoveTargetById=930120;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|page|p|postid|slug|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
+    ctl:ruleRemoveTargetById=932120;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|page|p|postid|slug|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
     ctl:ruleRemoveTargetById=932235;ARGS:/^(?:url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
-    ctl:ruleRemoveTargetById=932250;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
-    ctl:ruleRemoveTargetById=932260;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/"
+    ctl:ruleRemoveTargetById=932250;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|page|p|postid|slug|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/,\
+    ctl:ruleRemoveTargetById=932260;ARGS:/^(?:s|search|q|term|tag|category_name|plugin|checked\[\]|theme|stylesheet|page|p|postid|slug|url|return|redirect_to|wp_http_referer|_wp_http_referer)$/"
 
-# Every route of WordPress's own REST API, and the embed address each post links
-# to.
-SecRule TX:rest_route "@rx ^/(?:wp/v2/|oembed/1\.0/embed$)" \
+# Every route of WordPress's own REST API: under /wp/v2/, the block editor's
+# link previews under /wp-block-editor/v1/, and the embeds under /oembed/1.0/.
+SecRule TX:rest_route "@rx ^/(?:wp/v2/|wp-block-editor/v1/|oembed/1\.0/)" \
     "id:900708,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=930120;ARGS:/^(?:search|term|slug|url)$/,\
     ctl:ruleRemoveTargetById=932120;ARGS:/^(?:search|term|slug|url)$/,\