Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)

Adds nextcloud.conf, the twelfth change. Nextcloud's WebDAV paths allow
PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT and SEARCH. The account-name
cookie nc_username, and the fields that carry a search, a name, a file name or
a folder on the sign-in page, the Files app, public shares and the OCS API,
skip the four rules that read them as commands or system files. Comments and
the text editor's document skip the two rules for a command after a ";" too;
932235 keeps "; wget" refused. Requests recorded from Nextcloud 35.0.2, its
web pages, sync client 3.16.7 with chunked uploads and the OCS API, pass at
the defaults and while bodies are read.

Model: opus-5-5

SPEC.md

@@ -81,7 +81,7 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the eleven changes listed
+    - `internal/coreruleset`: the Core Rule Set, with the twelve changes listed
       under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
@@ -676,8 +676,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions; the eighth to eleventh changes below hold
-  gitea's, WordPress's, Drupal's and MediaWiki's.
+  holds an app's own exclusions; the eighth to twelfth changes below hold
+  gitea's, WordPress's, Drupal's, MediaWiki's and Nextcloud's.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -723,13 +723,15 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in eleven ways, since in front of
-gitea, WordPress, Drupal and MediaWiki it would otherwise refuse ordinary
-requests. The changes hold in front of every app, and no setting undoes them:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in twelve ways, since in front of
+gitea, WordPress, Drupal, MediaWiki and Nextcloud it would otherwise refuse
+ordinary requests. The changes hold in front of every app, and no setting undoes
+them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
-   Other methods stay refused.
+   Other methods stay refused, except on Nextcloud's WebDAV paths, where the
+   twelfth change allows the WebDAV methods Nextcloud uses.
 2. The request header `Expect` is allowed, since curl and git send it before
    some large uploads. `Content-Encoding` is allowed on a request whose body the
    Core Rule Set does not read, which by default is every request. git
@@ -756,10 +758,10 @@ requests. The changes hold in front of every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules, except on the
-    gitea, WordPress, Drupal and MediaWiki paths the eighth to eleventh changes
-    name. An app that uses one of these parameters as a file on the server, or
-    passes it to a shell, must check the value itself. A rule file can refuse it
-    instead.
+    gitea, WordPress, Drupal, MediaWiki and Nextcloud paths the eighth to
+    twelfth changes name. An app that uses one of these parameters as a file on
+    the server, or passes it to a shell, must check the value itself. A rule
+    file can refuse it instead.
 
 5. Two cookies are left out, and `Referer` keeps fewer rules:
     - The Core Rule Set reads the request without the `gitea_flash` and
@@ -1071,6 +1073,68 @@ requests. The changes hold in front of every app, and no setting undoes them:
     the site root or under `/w/`. An app other than MediaWiki that serves one of
     them must check these fields itself.
 
+12. On Nextcloud's paths, some fields skip the rules that refused ordinary
+    Nextcloud requests there, and its WebDAV methods are allowed.
+    `internal/coreruleset/nextcloud.conf` lists each rule and the request it
+    refused.
+
+    The sync client and the Files app use WebDAV. These methods are allowed on
+    `/remote.php/dav/`, `/public.php/dav/`, `/remote.php/webdav/` and
+    `/public.php/webdav/`, besides those of the first change:
+    - `PROPFIND` and `PROPPATCH`;
+    - `MKCOL`;
+    - `COPY` and `MOVE`;
+    - `REPORT` and `SEARCH`.
+
+    The cookie `nc_username` holds the name of the account signed in. It skips
+    the lists of system files and command names (930120, 932120, 932250, 932260)
+    on every path, since every request sends it.
+
+    These fields skip the same four rules, in the query or the body:
+    - On `/login`, for signing in:
+        - `user` and `password`;
+        - `redirect_url`, the page to go to after signing in.
+    - `dir`, the folder shown, on the paths under `/apps/files/`.
+    - The file names on a public share:
+        - `file` on the paths under `/apps/files_sharing/publicpreview/`;
+        - `path` and `files` on `/s/<token>/download`.
+    - On the OCS API, the paths under `/ocs/v1.php/` and `/ocs/v2.php/`:
+        - the searches `search` and `term`, and `from`, the page searched from;
+        - the names `groupid`, `userid`, `displayName` and `groups[]`;
+        - `value`, a new value of an account's details;
+        - `path`, `label`, `note` and `shareWith`, for a share;
+        - `message`, an account's status.
+
+    These fields of a JSON body skip the same four rules:
+    - On the OCS API, each field of the list above.
+    - `value` on `/apps/theming/ajax/updateStylesheet`, the name and slogan in
+      the theming settings.
+    - `filePath` on `/apps/text/session/<id>/save`, the document the editor
+      saves.
+    - `name` on `/remote.php/dav/systemtags/`, a new tag.
+
+    Some fields hold what a person writes. They skip the same four rules, and
+    the two that refused a command after a `;`, such as `; ls -la` (932125,
+    932230):
+    - `autosaveContent` on `/apps/text/session/<id>/save`, the text of the
+      document;
+    - `message` in the JSON body that posts a comment to
+      `/remote.php/dav/comments/files/<id>`;
+    - the XML body of a `PROPPATCH` that edits a comment.
+
+    The XML body of a `SEARCH` on `/remote.php/dav/`, the Files app's search,
+    skips the four rules.
+
+    932235 still refuses a command after a `;`, such as
+    `; wget http://example.com/x.sh`, in every field. So a sentence in a comment
+    with a command name such as `python3` right after a `;` is refused too.
+
+    These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
+    applies to a JSON field when the query has a parameter of that name, such as
+    `json.message`. Nextcloud's pages are matched at the site root and under
+    `/index.php/`. Elsewhere these fields keep every rule. An app other than
+    Nextcloud that serves one of these paths must check these fields itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.