Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- the web editor's tree_path, commit_summary and content;
- every field that names a branch, for Windows commands and command
  names: new_branch_name, old_branch_name, old_ref_name, from, to, head,
  base, branch and new_branch;
- message of a file changed through the API, for system files and
  Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/gitea.conf

@@ -315,6 +315,89 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/branches/edit$" \
 SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/lastcommit/" \
     "id:900633,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:refSubUrl"
 
+# The requests below name a file or a branch in a body field, which is read only
+# while SWW_WAF_BODY_LIMIT is set. Each field skips the rules that refused it.
+# Each field that names a branch skips these rules:
+#   932120: fix-powershell-module
+#   932260: feat/docker-support
+# None applies when the query has a parameter of the same name.
+
+# The web editor's save, new file and delete. The file's path, in tree_path,
+# skips these rules:
+#   930120: .htaccess
+#   932120: scripts/install-script.sh
+#   932260: docker-compose.yml
+# The commit's summary, in commit_summary, skips these rules:
+#   930120: Remove .htaccess
+#   932120: Remove scripts/install-script.sh
+# The file's text, in content, skips one rule:
+#   932235: a line that starts with install
+# A new branch for the commit is named in new_branch_name.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/(?:_edit|_new|_delete)/" \
+    "id:900660,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:tree_path|commit_summary|content|new_branch_name)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=932120;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=932260;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=930120;ARGS:commit_summary,\
+        ctl:ruleRemoveTargetById=932120;ARGS:commit_summary,\
+        ctl:ruleRemoveTargetById=932235;ARGS:content,\
+        ctl:ruleRemoveTargetById=932120;ARGS:new_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:new_branch_name"
+
+# A branch created on the web, in new_branch_name.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/_new/" \
+    "id:900661,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:new_branch_name "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:new_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:new_branch_name"
+
+# A branch renamed on the web, in from and to.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/rename$" \
+    "id:900662,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:from,\
+        ctl:ruleRemoveTargetById=932260;ARGS:from,\
+        ctl:ruleRemoveTargetById=932120;ARGS:to,\
+        ctl:ruleRemoveTargetById=932260;ARGS:to"
+
+# A branch created through the API, in new_branch_name. It starts from the
+# branch in old_branch_name, or the branch, tag or commit in old_ref_name.
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/branches$" \
+    "id:900663,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:new_branch_name|old_branch_name|old_ref_name)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:json.new_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.new_branch_name,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.old_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.old_branch_name,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.old_ref_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.old_ref_name"
+
+# A pull request opened through the API, from the branch in head into the
+# branch in base.
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/pulls$" \
+    "id:900664,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:head|base)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:json.head,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.head,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.base,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.base"
+
+# A file created, changed or deleted through the API, on the branch in branch.
+# A new branch for the commit is named in new_branch. The commit's message, in
+# message, skips these rules:
+#   930120: Remove .htaccess
+#   932120: Add a PowerShell build script
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/contents/" \
+    "id:900665,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:branch|new_branch|message)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:json.branch,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.branch,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.new_branch,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.new_branch,\
+        ctl:ruleRemoveTargetById=930120;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.message"
+
 # An artifact upload from actions/upload-artifact@v3 sends the header
 # Content-Range, which the Core Rule Set refused (920450).
 SecRule REQUEST_FILENAME \