Core Rule Set: a repository's name passes in the adopt form's id (closes #365)

While bodies are read, the forms that adopt or delete an unadopted
repository were refused when the repository's name held a command, a
system file's name or a shell path, such as alice/python3-app,
alice/.profile or robin/assets. id there now skips 930120, 932120, 932160
and 932260. The paths are gitea's /-/admin/repos/unadopted, Forgejo's
/admin/repos/unadopted, and /user/settings/repos/unadopted, which both
serve.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -2421,6 +2421,67 @@ func TestGiteaBodiesTheCoreRuleSetRefuses(t *testing.T) {
 	)
 }
 
+func TestGiteaFormsThatAdoptARepositoryLetItsNameThrough(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := readingBodies(t)
+
+	// The admin forms send the repository's owner and name in id, and the
+	// form in a user's settings only its name. robin/assets holds bin/as, a
+	// shell path.
+	ownerAndName := []string{
+		"alice%2Fpython3-app",
+		"alice%2Fpowershell-scripts",
+		"alice%2F.profile",
+		"robin%2Fassets",
+	}
+
+	for _, form := range []struct {
+		path string
+		ids  []string
+	}{
+		{"/-/admin/repos/unadopted", ownerAndName}, // gitea's
+		{"/admin/repos/unadopted", ownerAndName},   // Forgejo's
+		{
+			"/user/settings/repos/unadopted", // gitea's and Forgejo's
+			[]string{"python3-app", "powershell-scripts", ".profile"},
+		},
+	} {
+		r := request{http.MethodPost, form.path, []string{formData}}
+
+		for _, action := range []string{"adopt", "delete"} {
+			for _, id := range form.ids {
+				body := "id=" + id + "&action=" + action
+				wantBody(t, crs, r, body, coreruleset.Result{}, body)
+			}
+		}
+
+		// Another field keeps those rules.
+		body := "id=" + form.ids[0] + "&action=adopt&page=python3"
+		wantBody(t, crs, r, body, matched(932260), body)
+
+		// Attacks in id are still refused.
+		for _, attack := range []string{
+			sqlInjection,
+			scriptInjection,
+			commandInjection,
+			"..%2F..%2Fetc%2Fpasswd",
+		} {
+			body := "id=" + attack + "&action=adopt"
+			if got, _ := inspectBody(t, crs, r, body); got.Score < threshold {
+				t.Errorf("POST %s %s let through: %+v", form.path, body, got)
+			}
+		}
+	}
+
+	// On another path, id keeps those rules.
+	r := request{http.MethodPost, "/-/admin/repos", []string{formData}}
+	body := "id=alice%2Fpython3-app&action=adopt&q=&page=1"
+	wantBody(t, crs, r, body, matched(932260), body)
+}
+
 func TestTypesEndingInXMLOrJSONAndTextJSONAreRead(t *testing.T) {
 	t.Parallel()