From a7412e50eb281f723f0a344907ea7ceacaf447fa Mon Sep 17 00:00:00 2001 From: clawbot Date: Wed, 11 Nov 2026 11:29:42 +0000 Subject: [PATCH] Core Rule Set: Forgejo's searches at a branch or tag, of releases and of job logs pass (closes #350) `testdata/forgejo-requests.txt` records these Forgejo 17.0.1 searches with the hard values, file names and plain words, and the code search with code and a page opened from each search. `forgejo.conf` lets them through: - the code search at a branch or tag, where the home page's search box sends its search without a code indexer: `q` skips what it skips on gitea's code search, and `Referer` what it skips after gitea's searches; - the release search, page and API: `q` skips 930120, 932120, 932160, 932250 and 932260, since it matches tag names; - the job log search in the API: the same, without 932160. In `gitea.conf`, `q` on a repository's branches page and an owner's packages page also skips 932160, so `/bin/sh` passes there. `SPEC.md` lists both. Model: opus-5-5 --- SPEC.md | 41 +++- internal/coreruleset/forgejo.conf | 96 ++++++++ internal/coreruleset/forgejo_test.go | 49 +++- internal/coreruleset/gitea.conf | 7 + .../coreruleset/testdata/forgejo-requests.txt | 209 ++++++++++++++++++ 5 files changed, 388 insertions(+), 14 deletions(-) diff --git a/SPEC.md b/SPEC.md index e66a966..c98afe0 100644 --- a/SPEC.md +++ b/SPEC.md @@ -801,8 +801,9 @@ The changes hold in front of every app, and no setting undoes them: - a file named `java.lang.String.md`. Every request from such a page would be refused. `Referer` keeps the - other rules, except after some gitea searches (the eighth change). An - app that passes `Referer` to a shell must check it itself. + other rules, except after some searches of gitea and Forgejo (the eighth + and fifteenth changes). An app that passes `Referer` to a shell must + check it itself. 6. Responses are not inspected. A raw file from a repository, such as a shell script, looks to the response rules like source code leaking from the server. @@ -849,6 +850,11 @@ The changes hold in front of every app, and no setting undoes them: Some of these searches also skip the rule for Java class names (944130), which refused `org.apache.commons.logging`. + A branch or package name can hold a slash, as `feat/docker-support` + does. So `q` on a repository's branches page and on an owner's packages + page also skips the rule for shell paths (932160), which refused + `/bin/sh`. + - The path of these requests, which names a file: - a file's page; - its raw file; @@ -1583,21 +1589,40 @@ The changes hold in front of every app, and no setting undoes them: `/index.php/`. Elsewhere these fields keep every rule. An app other than Nextcloud that serves one of these paths must check these fields itself. -15. On Forgejo's paths, `q` on the search of a wiki skips the rules that refused +15. On Forgejo's paths, `q` on some of its searches skips the rules that refused ordinary Forgejo searches there. Forgejo is a fork of gitea, and the eighth change applies to its requests too. This change holds only what Forgejo sends and gitea does not. `internal/coreruleset/forgejo.conf` lists each - rule and the search it refused: + rule and the search it refused. The searches are: + - the search of a wiki, on `///wiki/search`; + - the search of a repository's releases, on `///releases` and + `/api/v1/repos///releases`; + - the search of a job's log, on + `/api/v1/repos///actions/jobs//logs`. + + There `q` skips these rules: - system files (930120), such as `.htaccess`; - Windows commands (932120), such as `powershell`; - - shell paths (932160), such as `/bin/sh`; + - shell paths (932160), such as `/bin/sh`, except on the search of a job's + log; - Unix commands (932250), such as `ls -la`; - command names (932260), such as `python3`. `; wget http://example.com/x.sh`, path traversal, and SQL and script - injection are still refused there. The path is `///wiki/search` - at the site root. An app other than Forgejo that serves such a path must - check `q` itself. + injection are still refused there. + + The search of a repository's code at a branch or a tag is on + `///search/branch/` and + `///search/tag/`. The search box on a repository's home + page sends its search there when Forgejo has no code indexer, as by default. + There `q` skips the rules it skips on gitea's search of code in the eighth + change. So code, such as `