Core Rule Set: MediaWiki's ordinary requests pass by default (closes #237)

Adds mediawiki.conf, the eleventh change: on MediaWiki's paths, the fields
that carry a search, a title, a name, a file name or an address skip the
four rules that read them as commands or system files, and the wikitext
fields skip the rules that refused saving a page. The reasons on the admin
pages skip only 930120 and 932120. /index.php counts as MediaWiki's only
with a page title in its query or after its path, since WordPress serves it
too. The requests recorded from MediaWiki 1.46.2, with and without short
URLs and on the admin pages, pass at the defaults and while bodies are
read. The app tests share the check of recorded requests and the list of
hard values.

Model: opus-5-5

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the ten changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the eleven changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -33,8 +33,8 @@ import (
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
 // SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
-// giteaExclusions for the third, wordpressExclusions for the fourth, and
-// drupalExclusions for the fifth.
+// giteaExclusions for the third, wordpressExclusions for the fourth,
+// drupalExclusions for the fifth, and mediawikiExclusions for the sixth.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -91,6 +91,9 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # So does the tenth.
 %s
 
+# And the eleventh.
+%s
+
 # The sixth: only the rules for requests are loaded, and no response is
 # inspected.
 Include @owasp_crs/REQUEST-*.conf
@@ -196,6 +199,13 @@ var wordpressExclusions string
 //go:embed drupal.conf
 var drupalExclusions string
 
+// mediawikiExclusions are the eleventh change: the fields of MediaWiki's
+// own requests that skip the rules that refused them there, as Coraza
+// directives.
+//
+//go:embed mediawiki.conf
+var mediawikiExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
@@ -309,7 +319,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the ten changes, at params'
+// New returns the Core Rule Set with the eleven changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -337,7 +347,8 @@ func New(params Params) (*CoreRuleSet, error) {
 	}
 
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
-		giteaExclusions, wordpressExclusions, drupalExclusions)
+		giteaExclusions, wordpressExclusions, drupalExclusions,
+		mediawikiExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))