Core Rule Set: gitea's ordinary requests pass by default (closes #198)

The eighth change, internal/waf/gitea.conf, has some fields skip the rules that refused ordinary gitea requests there, on gitea's paths only: searches, file names and branch names. Referer skips 944130 too. A registry's layer reuse skips 932260 on from, the seventh change. The new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE loads an operator's own exclusions before the Core Rule Set's rules. The start stops, in every mode, on a set file that cannot be read or does not parse, names smallwebwaf's own ids, or holds a directive such as SecRuleRemoveById. A test sends the recorded gitea requests at the defaults, none refused, and three attacks, all refused. Model: opus-5-5
2026-11-07 03:41:49 +00:00
1 parent 7fed6b6d36
commit 56aa8fb7b1
@@ -0,0 +1,393 @@
+# Ordinary gitea 1.27 requests that the Core Rule Set must let through at the
+# defaults. Each line is a path and query, and may end with one header after a
+# space. The tests of internal/waf inspect each as a GET. The Core Rule Set reads
+# the query and the headers the same way for any method.
+
+# Searches with ordinary words and symbols.
+/owner/repo/search?q=package.json
+/owner/repo/search?q=.gitignore
+/owner/repo/search?q=docker-compose.yml
+/owner/repo/search?q=python3
+/owner/repo/search?q=ssh%20key
+/owner/repo/search?q=feat%2Fdocker-support
+/owner/repo/search?q=ls%20-la
+/owner/repo/search?q=sed%20-i
+/owner/repo/search?q=%2Fbin%2Fsh
+/owner/repo/search?q=%60make%20check%60
+/owner/repo/search?q=%60whoami%60
+/owner/repo/search?q=fetch%28
+/owner/repo/search?q=%24%7BVAR%7D
+/owner/repo/search?q=%24%28pwd%29
+/owner/repo/search?q=process.env
+/owner/repo/search?q=%3Cimg%20src%3D
+/owner/repo/search?q=%3Cscript%3E
+/owner/repo/search?q=SELECT%20%2A%20FROM%20users%20WHERE
+/owner/repo/search?q=union%20select
+/owner/repo/search?q=http%3A%2F%2F127.0.0.1%3A8080
+/owner/repo/search?q=..%2F
+/owner/repo/search?q=%2Fetc%2Fpasswd
+/owner/repo/search?q=eval%28
+/owner/repo/search?q=chmod%20%2Bx
+/owner/repo/search?q=echo%20%24PATH
+/owner/repo/search?q=java.lang.Runtime
+/owner/repo/search?q=document.cookie
+/owner/repo/search?q=alert%281%29
+/owner/repo/search?q=__proto__
+/owner/repo/search?q=C%3A%5CWindows%5CSystem32
+/owner/repo/search?q=Invoke-WebRequest
+/owner/repo/search?q=if%20%28a%20%3D%3D%20b%29%20%7B
+/owner/repo/search?q=sudo%20apt%20install
+/owner/repo/search?q=~%2F.ssh%2Fconfig
+/owner/repo/search?q=.htaccess
+/owner/repo/search?q=%24_GET%5B
+/owner/repo/search?q=%24_POST
+/owner/repo/search?q=%24_SERVER%5B%27REQUEST_URI%27%5D
+/owner/repo/search?q=%3C%3Fphp%20echo
+/owner/repo/search?q=information_schema
+/owner/repo/search?q=LIKE%20%27%25foo%25%27
+/owner/repo/search?q=onClick%3D%7B
+/explore/code?q=SELECT%20%2A%20FROM%20users%20WHERE
+/explore/code?q=%3Cimg%20src%3D
+/owner/-/code?q=SELECT%20%2A%20FROM%20users%20WHERE
+/owner/-/code?q=%3Cimg%20src%3D
+/owner/repo/issues?type=all&state=open&q=SELECT%20%2A%20FROM%20users%20WHERE
+/owner/repo/issues?type=all&state=open&q=%3Cimg%20src%3D
+/owner/repo/issues/search?q=SELECT%20%2A%20FROM%20users%20WHERE
+/owner/repo/issues/search?q=%3Cimg%20src%3D
+/owner/repo/pulls?q=SELECT%20%2A%20FROM%20users%20WHERE
+/owner/repo/pulls?q=%3Cimg%20src%3D
+/issues?type=your_repositories&q=SELECT%20%2A%20FROM%20users%20WHERE
+/issues?type=your_repositories&q=%3Cimg%20src%3D
+/issues/search?q=SELECT%20%2A%20FROM%20users%20WHERE
+/issues/search?q=%3Cimg%20src%3D
+/pulls?type=your_repositories&q=SELECT%20%2A%20FROM%20users%20WHERE
+/pulls?type=your_repositories&q=%3Cimg%20src%3D
+/owner/repo/commits/branch/main/search?q=SELECT%20%2A%20FROM%20users%20WHERE
+/owner/repo/commits/branch/main/search?q=%3Cimg%20src%3D
+/api/v1/repos/issues/search?q=SELECT%20%2A%20FROM%20users%20WHERE
+/api/v1/repos/issues/search?q=%3Cimg%20src%3D
+/api/v1/repos/owner/repo/issues?q=SELECT%20%2A%20FROM%20users%20WHERE
+/api/v1/repos/owner/repo/issues?q=%3Cimg%20src%3D
+
+# Searches for the names of repositories, users, branches, tags and packages.
+/explore/repos?q=python3-app
+/explore/repos?q=.profile
+/explore/repos?q=powershell-scripts
+/api/v1/repos/search?q=docker-build
+/user/search_candidates?q=docker-ci
+/owner/repo/branches?q=feat%2Fdocker-support
+/owner/repo/tags?q=docker-v1.0
+/owner/-/packages?q=python3-requests
+/owner/-/packages?q=org.apache.commons.logging
+/repo/search?q=python3-app
+/repo/search?q=docker-build
+/repo/search?q=powershell-scripts
+/repo/search?q=.profile
+/owner?tab=repositories&q=python3-app
+/org?q=python3-app
+/owner/repo/issues/posters?q=docker-ci
+/owner/repo/pulls/posters?q=docker-ci
+/explore/users?q=docker-ci
+/explore/organizations?q=docker-ci
+/api/v1/users/search?q=docker-ci
+
+# Pages, raw files and edit pages of files, and the API's call for their
+# contents.
+/owner/repo/src/branch/main/package.json
+/owner/repo/raw/branch/main/package.json
+/owner/repo/_edit/main/package.json
+/api/v1/repos/owner/repo/contents/package.json
+/owner/repo/src/branch/main/.gitignore
+/owner/repo/raw/branch/main/.gitignore
+/owner/repo/_edit/main/.gitignore
+/api/v1/repos/owner/repo/contents/.gitignore
+/owner/repo/src/branch/main/docker-compose.yml
+/owner/repo/raw/branch/main/docker-compose.yml
+/owner/repo/_edit/main/docker-compose.yml
+/api/v1/repos/owner/repo/contents/docker-compose.yml
+/owner/repo/src/branch/main/Dockerfile
+/owner/repo/raw/branch/main/Dockerfile
+/owner/repo/_edit/main/Dockerfile
+/api/v1/repos/owner/repo/contents/Dockerfile
+/owner/repo/src/branch/main/.htaccess
+/owner/repo/raw/branch/main/.htaccess
+/owner/repo/_edit/main/.htaccess
+/api/v1/repos/owner/repo/contents/.htaccess
+/owner/repo/src/branch/main/rootfs/etc/passwd
+/owner/repo/raw/branch/main/rootfs/etc/passwd
+/owner/repo/_edit/main/rootfs/etc/passwd
+/api/v1/repos/owner/repo/contents/rootfs/etc/passwd
+/owner/repo/src/branch/main/bin/docker-entrypoint
+/owner/repo/raw/branch/main/bin/docker-entrypoint
+/owner/repo/_edit/main/bin/docker-entrypoint
+/api/v1/repos/owner/repo/contents/bin/docker-entrypoint
+/owner/repo/src/branch/main/scripts/python3-setup.sh
+/owner/repo/raw/branch/main/scripts/python3-setup.sh
+/owner/repo/_edit/main/scripts/python3-setup.sh
+/api/v1/repos/owner/repo/contents/scripts/python3-setup.sh
+/owner/repo/src/branch/main/src/java.base/share/classes/java/lang/Runtime.java
+/owner/repo/raw/branch/main/src/java.base/share/classes/java/lang/Runtime.java
+/owner/repo/_edit/main/src/java.base/share/classes/java/lang/Runtime.java
+/api/v1/repos/owner/repo/contents/src/java.base/share/classes/java/lang/Runtime.java
+/owner/repo/src/branch/main/java.lang.String.md
+/owner/repo/raw/branch/main/java.lang.String.md
+/owner/repo/_edit/main/java.lang.String.md
+/api/v1/repos/owner/repo/contents/java.lang.String.md
+/owner/repo/src/branch/main/META-INF/services/org.apache.commons.logging.LogFactory
+/owner/repo/raw/branch/main/META-INF/services/org.apache.commons.logging.LogFactory
+/owner/repo/_edit/main/META-INF/services/org.apache.commons.logging.LogFactory
+/api/v1/repos/owner/repo/contents/META-INF/services/org.apache.commons.logging.LogFactory
+/owner/repo/src/branch/main/process.env.d.ts
+/owner/repo/raw/branch/main/process.env.d.ts
+/owner/repo/_edit/main/process.env.d.ts
+/api/v1/repos/owner/repo/contents/process.env.d.ts
+/owner/repo/src/branch/main/document.write.js
+/owner/repo/raw/branch/main/document.write.js
+/owner/repo/_edit/main/document.write.js
+/api/v1/repos/owner/repo/contents/document.write.js
+/owner/repo/src/branch/main/test/fixtures/__proto__.json
+/owner/repo/raw/branch/main/test/fixtures/__proto__.json
+/owner/repo/_edit/main/test/fixtures/__proto__.json
+/api/v1/repos/owner/repo/contents/test/fixtures/__proto__.json
+/owner/repo/src/branch/main/install-script.sh
+/owner/repo/raw/branch/main/install-script.sh
+/owner/repo/_edit/main/install-script.sh
+/api/v1/repos/owner/repo/contents/install-script.sh
+/owner/repo/src/branch/main/src/backend/catalog/information_schema.sql
+/owner/repo/raw/branch/main/src/backend/catalog/information_schema.sql
+/owner/repo/_edit/main/src/backend/catalog/information_schema.sql
+/api/v1/repos/owner/repo/contents/src/backend/catalog/information_schema.sql
+/owner/repo/src/branch/main/docs/a%20b.xhtml
+/owner/repo/raw/branch/main/docs/a%20b.xhtml
+/owner/repo/_edit/main/docs/a%20b.xhtml
+/api/v1/repos/owner/repo/contents/docs/a%20b.xhtml
+/owner/repo/src/branch/main/%5Bdraft%5D.md
+/owner/repo/raw/branch/main/%5Bdraft%5D.md
+/owner/repo/_edit/main/%5Bdraft%5D.md
+/api/v1/repos/owner/repo/contents/%5Bdraft%5D.md
+/owner/repo/src/branch/main/notes.txt~
+/owner/repo/raw/branch/main/notes.txt~
+/owner/repo/_edit/main/notes.txt~
+/api/v1/repos/owner/repo/contents/notes.txt~
+
+# The download, blame, history, delete and preview pages of the files above
+# whose names the Core Rule Set checks in the path, and their downloads as
+# release attachments.
+/owner/repo/media/branch/main/notes.txt~
+/owner/repo/blame/branch/main/notes.txt~
+/owner/repo/commits/branch/main/notes.txt~
+/owner/repo/_delete/main/notes.txt~
+/owner/repo/media/branch/main/process.env.d.ts
+/owner/repo/blame/branch/main/process.env.d.ts
+/owner/repo/commits/branch/main/process.env.d.ts
+/owner/repo/_delete/main/process.env.d.ts
+/owner/repo/media/branch/main/docs/a%20b.xhtml
+/owner/repo/blame/branch/main/docs/a%20b.xhtml
+/owner/repo/commits/branch/main/docs/a%20b.xhtml
+/owner/repo/_delete/main/docs/a%20b.xhtml
+/owner/repo/media/branch/main/java.lang.String.md
+/owner/repo/blame/branch/main/java.lang.String.md
+/owner/repo/commits/branch/main/java.lang.String.md
+/owner/repo/_delete/main/java.lang.String.md
+/owner/repo/_preview/main/notes.txt~
+/owner/repo/_preview/main/process.env.d.ts
+/owner/repo/_preview/main/java.lang.String.md
+/owner/repo/releases/download/v1.0/notes.txt~
+/owner/repo/releases/download/v1.0/process.env.d.ts
+/owner/repo/releases/download/v1.0/java.lang.String.md
+/owner/repo/releases/download/v1.0/a%20b.xhtml
+
+# File names in the query string: the commit graph of a file, the API's lists
+# of its commits and of its contents, an issue opened from a template, the
+# sign-in page on the way to its edit page, and a diff's hidden lines.
+/owner/repo/graph?file=package.json
+/api/v1/repos/owner/repo/commits?path=package.json
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22package.json%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Fpackage.json
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Fpackage.json
+/owner/repo/graph?file=.gitignore
+/api/v1/repos/owner/repo/commits?path=.gitignore
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22.gitignore%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2F.gitignore
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2F.gitignore
+/owner/repo/graph?file=docker-compose.yml
+/api/v1/repos/owner/repo/commits?path=docker-compose.yml
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22docker-compose.yml%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Fdocker-compose.yml
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Fdocker-compose.yml
+/owner/repo/graph?file=.htaccess
+/api/v1/repos/owner/repo/commits?path=.htaccess
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22.htaccess%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2F.htaccess
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2F.htaccess
+/owner/repo/graph?file=rootfs%2Fetc%2Fpasswd
+/api/v1/repos/owner/repo/commits?path=rootfs%2Fetc%2Fpasswd
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22rootfs%2Fetc%2Fpasswd%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Frootfs%2Fetc%2Fpasswd
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Frootfs%2Fetc%2Fpasswd
+/owner/repo/graph?file=bin%2Fdocker-entrypoint
+/api/v1/repos/owner/repo/commits?path=bin%2Fdocker-entrypoint
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22bin%2Fdocker-entrypoint%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Fbin%2Fdocker-entrypoint
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Fbin%2Fdocker-entrypoint
+/owner/repo/graph?file=scripts%2Fpython3-setup.sh
+/api/v1/repos/owner/repo/commits?path=scripts%2Fpython3-setup.sh
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22scripts%2Fpython3-setup.sh%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Fscripts%2Fpython3-setup.sh
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Fscripts%2Fpython3-setup.sh
+/owner/repo/graph?file=src%2Fjava.base%2Fshare%2Fclasses%2Fjava%2Flang%2FRuntime.java
+/api/v1/repos/owner/repo/commits?path=src%2Fjava.base%2Fshare%2Fclasses%2Fjava%2Flang%2FRuntime.java
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22src%2Fjava.base%2Fshare%2Fclasses%2Fjava%2Flang%2FRuntime.java%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Fsrc%2Fjava.base%2Fshare%2Fclasses%2Fjava%2Flang%2FRuntime.java
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Fsrc%2Fjava.base%2Fshare%2Fclasses%2Fjava%2Flang%2FRuntime.java
+/owner/repo/graph?file=java.lang.String.md
+/api/v1/repos/owner/repo/commits?path=java.lang.String.md
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22java.lang.String.md%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Fjava.lang.String.md
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Fjava.lang.String.md
+/owner/repo/graph?file=META-INF%2Fservices%2Forg.apache.commons.logging.LogFactory
+/api/v1/repos/owner/repo/commits?path=META-INF%2Fservices%2Forg.apache.commons.logging.LogFactory
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22META-INF%2Fservices%2Forg.apache.commons.logging.LogFactory%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2FMETA-INF%2Fservices%2Forg.apache.commons.logging.LogFactory
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2FMETA-INF%2Fservices%2Forg.apache.commons.logging.LogFactory
+/owner/repo/graph?file=process.env.d.ts
+/api/v1/repos/owner/repo/commits?path=process.env.d.ts
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22process.env.d.ts%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Fprocess.env.d.ts
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Fprocess.env.d.ts
+/owner/repo/graph?file=document.write.js
+/api/v1/repos/owner/repo/commits?path=document.write.js
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22document.write.js%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Fdocument.write.js
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Fdocument.write.js
+/owner/repo/graph?file=test%2Ffixtures%2F__proto__.json
+/api/v1/repos/owner/repo/commits?path=test%2Ffixtures%2F__proto__.json
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22test%2Ffixtures%2F__proto__.json%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Ftest%2Ffixtures%2F__proto__.json
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Ftest%2Ffixtures%2F__proto__.json
+/owner/repo/graph?file=install-script.sh
+/api/v1/repos/owner/repo/commits?path=install-script.sh
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22install-script.sh%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Finstall-script.sh
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Finstall-script.sh
+/owner/repo/graph?file=src%2Fbackend%2Fcatalog%2Finformation_schema.sql
+/api/v1/repos/owner/repo/commits?path=src%2Fbackend%2Fcatalog%2Finformation_schema.sql
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22src%2Fbackend%2Fcatalog%2Finformation_schema.sql%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Fsrc%2Fbackend%2Fcatalog%2Finformation_schema.sql
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Fsrc%2Fbackend%2Fcatalog%2Finformation_schema.sql
+/owner/repo/graph?file=docs%2Fa%20b.xhtml
+/api/v1/repos/owner/repo/commits?path=docs%2Fa%20b.xhtml
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22docs%2Fa%20b.xhtml%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2Fdocs%2Fa%20b.xhtml
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2Fdocs%2Fa%20b.xhtml
+/owner/repo/graph?file=%5Bdraft%5D.md
+/api/v1/repos/owner/repo/commits?path=%5Bdraft%5D.md
+/api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22%5Bdraft%5D.md%22%5D%7D
+/owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2F%5Bdraft%5D.md
+/user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2F%5Bdraft%5D.md
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=process.env.d.ts&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=java.lang.String.md&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=install-script.sh&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=information_schema.sql&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=document.write.js&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=__proto__.json&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=src%2Fjava.base%2Fshare%2Fclasses%2Fjava%2Flang%2FRuntime.java&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=index.xhtml&style=unified&direction=down&wiki=false
+
+# File names of attachments uploaded through the API, to a release, an issue and
+# a comment.
+/api/v1/repos/owner/repo/releases/1/assets?name=package.json
+/api/v1/repos/owner/repo/releases/1/assets?name=.gitignore
+/api/v1/repos/owner/repo/releases/1/assets?name=docker-compose.yml
+/api/v1/repos/owner/repo/releases/1/assets?name=.htaccess
+/api/v1/repos/owner/repo/releases/1/assets?name=docker-entrypoint
+/api/v1/repos/owner/repo/releases/1/assets?name=python3-setup.sh
+/api/v1/repos/owner/repo/releases/1/assets?name=Runtime.java
+/api/v1/repos/owner/repo/releases/1/assets?name=org.apache.commons.logging.LogFactory
+/api/v1/repos/owner/repo/releases/1/assets?name=%5Bdraft%5D.md
+/api/v1/repos/owner/repo/releases/1/assets?name=notes.txt~
+/api/v1/repos/owner/repo/releases/1/assets?name=install-script.sh
+/api/v1/repos/owner/repo/issues/1/assets?name=install-script.sh
+/api/v1/repos/owner/repo/issues/comments/1/assets?name=install-script.sh
+/api/v1/repos/owner/repo/releases/1/assets?name=process.env.d.ts
+/api/v1/repos/owner/repo/issues/1/assets?name=process.env.d.ts
+/api/v1/repos/owner/repo/issues/comments/1/assets?name=process.env.d.ts
+/api/v1/repos/owner/repo/releases/1/assets?name=java.lang.String.md
+/api/v1/repos/owner/repo/issues/1/assets?name=java.lang.String.md
+/api/v1/repos/owner/repo/issues/comments/1/assets?name=java.lang.String.md
+/api/v1/repos/owner/repo/releases/1/assets?name=information_schema.sql
+/api/v1/repos/owner/repo/issues/1/assets?name=information_schema.sql
+/api/v1/repos/owner/repo/issues/comments/1/assets?name=information_schema.sql
+/api/v1/repos/owner/repo/releases/1/assets?name=document.write.js
+/api/v1/repos/owner/repo/issues/1/assets?name=document.write.js
+/api/v1/repos/owner/repo/issues/comments/1/assets?name=document.write.js
+/api/v1/repos/owner/repo/releases/1/assets?name=__proto__.json
+/api/v1/repos/owner/repo/issues/1/assets?name=__proto__.json
+/api/v1/repos/owner/repo/issues/comments/1/assets?name=__proto__.json
+/api/v1/repos/owner/repo/releases/1/assets?name=index.xhtml
+/api/v1/repos/owner/repo/issues/1/assets?name=index.xhtml
+/api/v1/repos/owner/repo/issues/comments/1/assets?name=index.xhtml
+
+# An artifact upload from actions/upload-artifact@v3, which sends Content-Range.
+/api/actions_pipeline/_apis/pipelines/workflows/1/artifacts/9b7c1f3a/upload?itemPath=artifact%2Freport.txt Content-Range: bytes 0-9/10
+
+# Branch and tag names in the query string: deleting and restoring a branch,
+# starting a release from a tag, a branch protection rule, a directory listing's
+# last commits, and a container image push that reuses a layer.
+/owner/repo/branches/delete?name=docker-build&page=1
+/owner/repo/branches/restore?branch_id=1&name=docker-build&page=1
+/owner/repo/releases/new?tag=docker-build
+/owner/repo/settings/branches/edit?rule_name=docker-build
+/owner/repo/lastcommit/main/src?refSubUrl=branch%2Fdocker-build
+/v2/owner/app/blobs/uploads/?mount=sha256%3A0000&from=owner%2Fdocker-build
+/owner/repo/branches/delete?name=feat%2Fdocker-support&page=1
+/owner/repo/branches/restore?branch_id=1&name=feat%2Fdocker-support&page=1
+/owner/repo/releases/new?tag=feat%2Fdocker-support
+/owner/repo/settings/branches/edit?rule_name=feat%2Fdocker-support
+/owner/repo/lastcommit/main/src?refSubUrl=branch%2Ffeat%2Fdocker-support
+/v2/owner/app/blobs/uploads/?mount=sha256%3A0000&from=owner%2Ffeat%2Fdocker-support
+/owner/repo/branches/delete?name=renovate%2Fdocker-build-push-action-6.x&page=1
+/owner/repo/branches/restore?branch_id=1&name=renovate%2Fdocker-build-push-action-6.x&page=1
+/owner/repo/releases/new?tag=renovate%2Fdocker-build-push-action-6.x
+/owner/repo/settings/branches/edit?rule_name=renovate%2Fdocker-build-push-action-6.x
+/owner/repo/lastcommit/main/src?refSubUrl=branch%2Frenovate%2Fdocker-build-push-action-6.x
+/v2/owner/app/blobs/uploads/?mount=sha256%3A0000&from=owner%2Frenovate%2Fdocker-build-push-action-6.x
+/owner/repo/branches/delete?name=python3-migration&page=1
+/owner/repo/branches/restore?branch_id=1&name=python3-migration&page=1
+/owner/repo/releases/new?tag=python3-migration
+/owner/repo/settings/branches/edit?rule_name=python3-migration
+/owner/repo/lastcommit/main/src?refSubUrl=branch%2Fpython3-migration
+/v2/owner/app/blobs/uploads/?mount=sha256%3A0000&from=owner%2Fpython3-migration
+/owner/repo/branches/delete?name=ansible-roles&page=1
+/owner/repo/branches/restore?branch_id=1&name=ansible-roles&page=1
+/owner/repo/releases/new?tag=ansible-roles
+/owner/repo/settings/branches/edit?rule_name=ansible-roles
+/owner/repo/lastcommit/main/src?refSubUrl=branch%2Fansible-roles
+/v2/owner/app/blobs/uploads/?mount=sha256%3A0000&from=owner%2Fansible-roles
+/owner/repo/branches/delete?name=whoami&page=1
+/owner/repo/branches/restore?branch_id=1&name=whoami&page=1
+/owner/repo/releases/new?tag=whoami
+/owner/repo/settings/branches/edit?rule_name=whoami
+/owner/repo/lastcommit/main/src?refSubUrl=branch%2Fwhoami
+/v2/owner/app/blobs/uploads/?mount=sha256%3A0000&from=owner%2Fwhoami
+
+# Pages a signed-in user opens.
+/
+/owner/repo
+/owner/repo/issues
+/owner/repo/pulls
+/owner/repo/releases
+/owner/repo/wiki
+/owner/repo/activity
+/owner/repo/branches
+/owner/repo/tags
+/owner/repo/settings
+/owner/repo/actions
+/owner/repo/compare/main...main
+/owner/repo/commits/branch/main
+/owner/repo/archive/main.zip
+/notifications
+/user/settings
+/user/settings/applications
+/explore/repos
+/-/admin