SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

Each app's fixes are one .conf file and one entry in apps. They apply
only while Inspect has set the app's transaction variable, such as
tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only
its apps' fixes; while SWW_APPS is unset, every hostname gets every
app's fixes. Listing forgejo, a fork of gitea, brings gitea's fixes too.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

internal/coreruleset/forgejo_test.go

@@ -4,13 +4,66 @@ import (
 	"net/http"
 	"slices"
 	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
+// forgejo is Forgejo's name in SWW_APPS.
+const forgejo = "forgejo"
+
+// forgejoHost is the hostname of the tests of SWW_APPS that serves Forgejo.
+const forgejoHost = "code.example"
+
+func TestForgejoFixesApplyOnlyToAHostnameThatServesForgejo(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{
+		forgejoHost: {forgejo}, otherHost: {wordpress},
+	})
+
+	// A search of a wiki, a search of the admin page, and a file name in
+	// Forgejo's flash cookie, which only Forgejo's fixes let through.
+	for _, fixed := range []struct {
+		request request
+		result  coreruleset.Result
+	}{
+		{get("/alice/tools/wiki/search?q=python3"), matched(932260)},
+		{get("/admin/repos?q=python3"), matched(932260)},
+		{
+			get("/alice/tools", "Cookie: flash=success%3DFile%2Bpackage.json%2Bdeleted"),
+			matched(930120),
+		},
+	} {
+		wantResult(
+			t,
+			crs,
+			withHost(fixed.request, forgejoHost),
+			coreruleset.Result{},
+		)
+		wantResult(t, crs, withHost(fixed.request, otherHost), fixed.result)
+	}
+}
+
+func TestHostnameListingForgejoGetsGiteasFixesToo(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{forgejoHost: {forgejo}})
+
+	for _, fixed := range giteaFixed {
+		wantResult(
+			t,
+			crs,
+			withHost(fixed.request, forgejoHost),
+			coreruleset.Result{},
+		)
+	}
+}
+
 // forgejoSearches are Forgejo's searches whose q skips some rules: those of
-// a wiki, of releases and of a job's log, from the fifteenth change, and the
-// searches for a name, from the eighth. The search of code at a branch or tag
-// is not one of them: there, as on gitea's search of code, q lets these
-// attacks through.
+// a wiki, of releases, of a job's log and of the admin page, from Forgejo's
+// fixes, and the searches for a name, from gitea's. The search of code at a
+// branch or tag is not one of them: there, as on gitea's search of code, q
+// lets these attacks through.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var forgejoSearches = []string{
@@ -18,6 +71,7 @@ var forgejoSearches = []string{
 	"/alice/tools/releases",
 	"/api/v1/repos/alice/tools/releases",
 	"/api/v1/repos/alice/tools/actions/jobs/1/logs",
+	"/admin/repos",
 	"/explore/repos",
 	"/explore/users",
 	"/alice/tools/branches",
@@ -63,11 +117,11 @@ func TestForgejoExclusionsAreNarrow(t *testing.T) {
 
 	crs := atDefaults(t)
 
-	// /bin/sh and the hard values, which q lets through on the searches of
-	// the fifteenth change and on those of branches and packages, stay
+	// /bin/sh and the hard values, which q lets through on the searches
+	// named in Forgejo's fixes and on those of branches and packages, stay
 	// refused in q on paths near them and in another field on them.
 	// /alice/wiki/search would be the code search of a repository named
-	// wiki, where the eighth change lets q through. Forgejo has no owner
+	// wiki, where gitea's fixes let q through. Forgejo has no owner
 	// named api, so the paths under /api/ here are not searches.
 	for _, target := range []string{
 		"/alice/tools/wiki/Home?q=",