Core Rule Set: Drupal's ordinary requests pass by default (closes #236)

Adds drupal.conf, the tenth change: on Drupal's paths, the fields that
carry a search, a name, a file name or an address skip the rules that
refused ordinary requests there. The recorded requests from Drupal 11.4
pass at the defaults and while bodies are read; SQL injection, path
traversal and script injection stay refused on those fields. Drupal's
tests share the reader of recorded requests and the attack constants
with the other apps' tests.

Model: opus-5-5

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the nine changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the ten changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -33,7 +33,8 @@ import (
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
 // SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
-// giteaExclusions for the third, and wordpressExclusions for the fourth.
+// giteaExclusions for the third, wordpressExclusions for the fourth, and
+// drupalExclusions for the fifth.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -87,6 +88,9 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # The ninth change comes before the rules for the same reason.
 %s
 
+# So does the tenth.
+%s
+
 # The sixth: only the rules for requests are loaded, and no response is
 # inspected.
 Include @owasp_crs/REQUEST-*.conf
@@ -185,6 +189,13 @@ var giteaExclusions string
 //go:embed wordpress.conf
 var wordpressExclusions string
 
+// drupalExclusions are the tenth change: the fields of Drupal's own
+// requests that skip the rules that refused them there, as Coraza
+// directives.
+//
+//go:embed drupal.conf
+var drupalExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
@@ -298,7 +309,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the nine changes, at params'
+// New returns the Core Rule Set with the ten changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -326,7 +337,7 @@ func New(params Params) (*CoreRuleSet, error) {
 	}
 
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
-		giteaExclusions, wordpressExclusions)
+		giteaExclusions, wordpressExclusions, drupalExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))