Core Rule Set: WordPress's ordinary requests pass by default (closes #235)

Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused recorded WordPress 7.1.4 traffic. Add the recorded requests,
a test at the defaults and reading bodies, and list WordPress in the README.

Model: opus-5-5

internal/waf/wordpress.conf

@@ -0,0 +1,85 @@
+# The ninth change: on WordPress's paths, some fields skip the rules that refused
+# ordinary WordPress requests there. Each exclusion runs with the request, before
+# the rules it switches off, so this file is loaded before the Core Rule Set's
+# rules. Each comment names a request the rule refused. All but the first apply
+# only while SWW_WAF_BODY_LIMIT is set, since they name fields of a body.
+
+# The block editor saves a post with POST and the header X-HTTP-Method-Override:
+# PUT, which the Core Rule Set refused (920450). So does saving a user's editor
+# preferences.
+SecRule REQUEST_FILENAME "@beginsWith /wp-json/" \
+    "id:900700,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=920450;REQUEST_HEADERS_NAMES:X-HTTP-Method-Override"
+
+# The block editor sends a post's HTML in the JSON field content, which skips
+# these rules when saving or autosaving a post, a page or another type of post:
+#   930120: cat /etc/hosts
+#   932230: a code block with a shell pipeline and an SQL query
+#   932250: the same code block
+#   934100: console.log('ok')
+#   941100: <iframe src="..." onload="...">
+#   941110: <script>
+#   941120: onload=
+#   941160: <img src=
+#   941180: <!-- wp:paragraph -->, the comment that starts every block
+#   941390: console.log(
+#   942100: SELECT name FROM users WHERE id = 1;
+#   942190: how to select a table from the catalog
+#   942270: how to select a table from the catalog
+SecRule REQUEST_FILENAME \
+    "@rx ^/wp-json/wp/v2/[^/]+(?:/[0-9]+(?:/autosaves)?)?$" \
+    "id:900701,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=932230;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=932250;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=934100;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=941100;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=941110;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=941120;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=941160;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=941180;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=941390;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=942100;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=942190;ARGS:json.content,\
+    ctl:ruleRemoveTargetById=942270;ARGS:json.content"
+
+# A reply to a comment from the list of comments, in content:
+#   932125: ls -la, in the reply's text
+#   932230: ls -la, in the reply's text
+#   932250: ls -la, in the reply's text
+SecRule REQUEST_FILENAME "@streq /wp-admin/admin-ajax.php" \
+    "id:900702,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=932125;ARGS:content,\
+    ctl:ruleRemoveTargetById=932230;ARGS:content,\
+    ctl:ruleRemoveTargetById=932250;ARGS:content"
+
+# Saving a plugin's or a theme's file from its file editor sends the file in
+# newcontent, which skips these rules, each of which refused saving the plugin
+# Hello Dolly's hello.php. Some of them refused only the whole file:
+#   932140: if ( 'en_' !== substr(
+#   932235: the whole file
+#   933100: the whole file
+#   933160: if ( 'en_' !== substr(
+#   933210: $lyrics = explode(
+#   941100: <style type='text/css'>
+#   941160: <style type='text/css'>
+#   941190: the whole file
+#   942151: if ( 'en_' !== substr(
+#   942540: Dolly'll never go away again";
+SecRule REQUEST_FILENAME "@streq /wp-admin/admin-ajax.php" \
+    "id:900703,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=932140;ARGS:newcontent,\
+    ctl:ruleRemoveTargetById=932235;ARGS:newcontent,\
+    ctl:ruleRemoveTargetById=933100;ARGS:newcontent,\
+    ctl:ruleRemoveTargetById=933160;ARGS:newcontent,\
+    ctl:ruleRemoveTargetById=933210;ARGS:newcontent,\
+    ctl:ruleRemoveTargetById=941100;ARGS:newcontent,\
+    ctl:ruleRemoveTargetById=941160;ARGS:newcontent,\
+    ctl:ruleRemoveTargetById=941190;ARGS:newcontent,\
+    ctl:ruleRemoveTargetById=942151;ARGS:newcontent,\
+    ctl:ruleRemoveTargetById=942540;ARGS:newcontent"
+
+# Signing in, in pwd, where a password holds any characters:
+#   930120: a password ending in /etc/hosts
+SecRule REQUEST_FILENAME "@streq /wp-login.php" \
+    "id:900704,phase:1,pass,nolog,ctl:ruleRemoveTargetById=930120;ARGS:pwd"