Core Rule Set: the package registries' searches of gitea and Forgejo pass (closes #354)

Recorded from gitea 1.27.3 and Forgejo 17.0.1 with each registry's own
client, and curl for the requests no client sends, with python3,
powershell, ls -la, .htaccess, file names and plain words. q on the
Cargo, Chef, Composer and Conan searches and NuGet's search service
joins 900603. 900605 lets /bin/sh through on Composer and Conan. New:
900609 for npm's text; 900611, in phase 2, lets one q shaped as a Conan
reference with no +, */ or --, such as zlib/*, skip 942100 if 942100
passes it with each /* comment read as a space; 900612 for NuGet's
Search(), Packages() and their counts: searchTerm, $filter, and the
names $filter, $orderby and $top for 942290.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

SPEC.md

@@ -888,7 +888,8 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         - a repository's branches, tags and packages pages;
         - an owner's packages page;
         - the admin page of packages;
-        - the API's search of packages.
+        - the API's search of packages;
+        - the searches of the Composer and Conan registries.
 
     - `q` on gitea's other searches, for the same four rules. Words such as
       `python3`, `powershell`, `ls -la` and `.htaccess` were refused there. The
@@ -905,7 +906,9 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         - the admin lists of users, organisations, repositories, unadopted
           repositories and emails;
         - the API's searches of topics, of an organisation's teams and of
-          emails.
+          emails;
+        - the searches of the Cargo, Chef, Composer and Conan registries, and
+          the NuGet registry's search service.
 
         Most send `q` in the query string. The admin forms that adopt a
         repository or activate an email send it in the body. gitea serves its
@@ -916,6 +919,31 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
           and a name, such as `alice/python3-app`;
         - `name` of the search of a repository's milestones.
 
+    - Fields of the package registries' searches:
+        - `text` of the npm registry's search, for the same four rules and the
+          rule for shell paths (932160). An npm name can hold a slash, as
+          `@alice/tools-cli` does.
+        - `searchTerm` of the NuGet v2 API's searches, for the same four rules.
+          These are the searches:
+            - `Search()` and `Packages()`;
+            - `Search()/$count` and `Packages()/$count`, which count their
+              results.
+        - `$filter` of those searches, for the lists of system files and Windows
+          commands (930120, 932120). It holds an expression such as
+          `tolower(Id) eq 'python3'`.
+        - The names `$filter`, `$orderby` and `$top` on those searches, for the
+          rule for MongoDB operators (942290). It refused every such search.
+        - `q` of a Conan search, for the rule for SQL injection (942100), which
+          refused the pattern `zlib/*`. `q` skips it only when the request has
+          one `q`, in the query string or the body. That `q` has the shape of a
+          Conan reference. A reference is a name, then optionally `/` and a
+          version, then optionally `@` and a user, then optionally `/` and a
+          channel. Each part is made of letters, digits, `_`, `.`, `-` and `*`.
+          A part holds no `+`, since 942100 reads `+` as a space. `q` also holds
+          no `*/`, which ends an SQL comment, and no `--`, which starts one. And
+          942100 finds no SQL injection in `q` once each comment that `/*`
+          starts, an unclosed one included, is replaced by a space.
+
     - The path of these requests, which names a file:
         - a file's page;
         - its raw file;