Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237)

Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields
that carry a search, a title, a name, a file name or an address skip the
four rules that read them as commands or system files, and the wikitext
fields skip the rules that refused saving a page. The reasons on the admin
pages skip only 930120 and 932120. /index.php counts as MediaWiki's only
with a page title in its query or after its path, since WordPress serves it
too. The requests recorded from MediaWiki 1.46.2, with and without short
URLs and on the admin pages, pass at the defaults and while bodies are
read. The app tests share the check of recorded requests and the list of
hard values.

Model: opus-5-5

SPEC.md

@@ -81,7 +81,7 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the ten changes listed
+    - `internal/coreruleset`: the Core Rule Set, with the eleven changes listed
       under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
@@ -676,8 +676,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions; the eighth, ninth and tenth changes below hold
-  gitea's, WordPress's and Drupal's.
+  holds an app's own exclusions; the eighth to eleventh changes below hold
+  gitea's, WordPress's, Drupal's and MediaWiki's.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -723,9 +723,9 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in ten ways, since in front of
-gitea, WordPress and Drupal it would otherwise refuse ordinary requests. The
-changes hold in front of every app, and no setting undoes them:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in eleven ways, since in front of
+gitea, WordPress, Drupal and MediaWiki it would otherwise refuse ordinary
+requests. The changes hold in front of every app, and no setting undoes them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
@@ -756,9 +756,9 @@ changes hold in front of every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules, except on the
-    gitea, WordPress and Drupal paths the eighth, ninth and tenth changes name.
-    An app that uses one of these parameters as a file on the server, or passes
-    it to a shell, must check the value itself. A rule file can refuse it
+    gitea, WordPress, Drupal and MediaWiki paths the eighth to eleventh changes
+    name. An app that uses one of these parameters as a file on the server, or
+    passes it to a shell, must check the value itself. A rule file can refuse it
     instead.
 
 5. Two cookies are left out, and `Referer` keeps fewer rules:
@@ -988,6 +988,71 @@ changes hold in front of every app, and no setting undoes them:
     followed by a hyphen and more letters, so `/api` counts too. An app other
     than Drupal that serves one of them must check these fields itself.
 
+11. On MediaWiki's paths, some fields skip the rules that refused ordinary
+    MediaWiki requests there. `internal/coreruleset/mediawiki.conf` lists each
+    rule and the request it refused. These fields skip the lists of system files
+    and command names (930120, 932120, 932250, 932260), in the query or the
+    body:
+    - On MediaWiki's pages, which are `/index.php` and the paths under
+      `/index.php/` and `/wiki/`:
+        - the searches `search` and `ilsearch`;
+        - the titles `title`, `page` and `target`;
+        - `from`, `to` and `prefix`, which limit a list of pages;
+        - the user names `user`, `username` and `wpTarget`;
+        - the file names `filename` and `wpDestFile`;
+        - `returnto` and `returntoquery`, the page and query to go back to after
+          signing in.
+    - On `/api.php`:
+        - the searches `search`, `srsearch` and `pssearch`;
+        - the titles `titles`, `title`, `page` and `bltitle`;
+        - `from` and `to`, the titles of a page being moved;
+        - the starts of lists `apfrom`, `apto`, `apprefix`, `aifrom`,
+          `aiprefix`, `aufrom` and `auprefix`;
+        - `gsrsearch`, `gpssearch`, `gapfrom` and `gbltitle`, which a generator
+          sends in place of `srsearch`, `pssearch`, `apfrom` and `bltitle`;
+        - `euquery`, an address;
+        - the user names `ucuser`, `bkusers` and `user`;
+        - `summary`, `sectiontitle`, `filename`, `comment` and `reason`;
+        - `lgname`, `lgpassword`, `username` and `password`, for signing in.
+    - `q` on `/rest.php/` and the paths under it.
+
+    `modules` on `/load.php` skips 930120 alone, because it lists the scripts
+    and styles a page loads.
+
+    These fields of a body skip the rules that refused them:
+    - On MediaWiki's pages, for the same four rules:
+        - `wpSummary`, the summary of an edit;
+        - `wpUploadDescription`, the description of an uploaded file;
+        - `wpName` and `wpPassword`, for signing in;
+        - `wpOldTitle`, `wpNewTitleMain` and `wpReason`, for moving a page.
+    - `comment` in the JSON body of `/rest.php/`, for the same four rules.
+    - On MediaWiki's pages, for 930120 and 932120 alone, the reasons on the
+      admin pages:
+        - `wpReason-other`, for blocking a user;
+        - `user-reason`, for changing a user's groups;
+        - `mwProtect-reason`, for protecting a page.
+    - The wikitext of a page, which holds templates, tables and any code it
+      shows:
+        - `wpTextbox1` on MediaWiki's pages;
+        - `text`, `appendtext` and `prependtext` on `/api.php`;
+        - `source` in the JSON body of `/rest.php/`.
+
+    These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
+    applies when the query has a parameter of the same name.
+
+    The names of uploaded files skip 932180 on MediaWiki's pages and on
+    `/api.php`, so a picture named `Notes on .htaccess.png` can be uploaded.
+    MediaWiki refuses a file whose extension it does not allow.
+
+    `/index.php` itself counts as MediaWiki's only when its query has a `title`,
+    as in `/index.php?title=Main_Page`. WordPress serves `/index.php` too. A
+    wiki without short URLs serves its pages under `/index.php/`, as in
+    `/index.php/Main_Page`, and its sign-in and upload forms post there.
+
+    Elsewhere these fields keep every rule. The paths are those of MediaWiki at
+    the site root or under `/w/`. An app other than MediaWiki that serves one of
+    them must check these fields itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.