Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)

Adds nextcloud.conf, the fourteenth change. Nextcloud's WebDAV paths allow
PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK and UNLOCK, and
the body of a PUT there, an uploaded file, is not read. The cookie
nc_username, and the fields that carry a search, a name, a file name or a
folder, skip the four rules that read them as commands or system files.
Comments, a share's note, a status and a document's text also skip the rules
that refused ordinary sentences, and the document the two that refused a
shell code block. Requests recorded from Nextcloud 35.0.2, its web pages, sync
client 3.16.7 and the OCS API pass at the defaults and while bodies are read.

Model: opus-5-5

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the thirteen changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the fourteen changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -35,8 +35,8 @@ import (
 // SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
 // giteaExclusions for the third, wordpressExclusions for the fourth,
 // drupalExclusions for the fifth, mediawikiExclusions for the sixth,
-// mastodonExclusions for the seventh, and vaultwardenExclusions for the
-// eighth.
+// mastodonExclusions for the seventh, vaultwardenExclusions for the eighth,
+// and nextcloudExclusions for the ninth.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -99,7 +99,10 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # So does the twelfth.
 %s
 
-# And the thirteenth.
+# So does the thirteenth.
+%s
+
+# And the fourteenth.
 %s
 
 # The sixth: only the rules for requests are loaded, and no response is
@@ -228,6 +231,14 @@ var mastodonExclusions string
 //go:embed vaultwarden.conf
 var vaultwardenExclusions string
 
+// nextcloudExclusions are the fourteenth change: the fields of Nextcloud's
+// own requests that skip the rules that refused them there, the WebDAV
+// methods it uses, its cookie of the account's name, and its uploads,
+// whose bodies are not read, as Coraza directives.
+//
+//go:embed nextcloud.conf
+var nextcloudExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
@@ -341,7 +352,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the thirteen changes, at params'
+// New returns the Core Rule Set with the fourteen changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -370,7 +381,8 @@ func New(params Params) (*CoreRuleSet, error) {
 
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
 		giteaExclusions, wordpressExclusions, drupalExclusions,
-		mediawikiExclusions, mastodonExclusions, vaultwardenExclusions)
+		mediawikiExclusions, mastodonExclusions, vaultwardenExclusions,
+		nextcloudExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))