Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- the web editor's tree_path, commit_summary and content;
- new_branch_name of a branch created on the web or the API;
- from and to of a renamed branch, on gitea's and Forgejo's paths;
- head of a pull request and message of a file, through the API.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/gitea.conf

@@ -298,6 +298,66 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/branches/edit$" \
 SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/lastcommit/" \
     "id:900633,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:refSubUrl"
 
+# The requests below name a file or a branch in a body field, which is read only
+# while SWW_WAF_BODY_LIMIT is set. Each field skips the rules that refused it.
+# None applies when the query has a parameter of the same name.
+
+# The web editor's save, new file and delete. The file's path, in tree_path,
+# skips these rules:
+#   930120: .htaccess
+#   932120: scripts/install-script.sh
+#   932260: docker-compose.yml
+# The commit's summary, in commit_summary, skips these rules:
+#   930120: Remove .htaccess
+#   932120: Remove scripts/install-script.sh
+# The file's text, in content, skips one rule:
+#   932235: a line that starts with install
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/(?:_edit|_new|_delete)/" \
+    "id:900660,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:tree_path|commit_summary|content)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=932120;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=932260;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=930120;ARGS:commit_summary,\
+        ctl:ruleRemoveTargetById=932120;ARGS:commit_summary,\
+        ctl:ruleRemoveTargetById=932235;ARGS:content"
+
+# The rest name a branch, which skips the list of command names (932260) there.
+# It refused docker-build, python3-docs and feat/docker-support.
+
+# A branch created on the web, in new_branch_name.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/_new/" \
+    "id:900661,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:new_branch_name "@eq 0" \
+        "ctl:ruleRemoveTargetById=932260;ARGS:new_branch_name"
+
+# A branch renamed on the web, in from and to.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/rename$" \
+    "id:900662,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932260;ARGS:from,\
+        ctl:ruleRemoveTargetById=932260;ARGS:to"
+
+# A branch created through the API, in new_branch_name.
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/branches$" \
+    "id:900663,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:json.new_branch_name "@eq 0" \
+        "ctl:ruleRemoveTargetById=932260;ARGS:json.new_branch_name"
+
+# A pull request opened through the API, in head.
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/pulls$" \
+    "id:900664,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:json.head "@eq 0" \
+        "ctl:ruleRemoveTargetById=932260;ARGS:json.head"
+
+# A file created, changed or deleted through the API. The commit's message, in
+# message, skips the list of Windows commands (932120), which refused Add a
+# PowerShell build script.
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/contents/" \
+    "id:900665,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:json.message "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:json.message"
+
 # An artifact upload from actions/upload-artifact@v3 sends the header
 # Content-Range, which the Core Rule Set refused (920450).
 SecRule REQUEST_FILENAME \