Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- tree_path, commit_summary and content on the web editor's pages that
  commit a change: edit, new file, delete, upload, patch and
  cherry-pick;
- every field that names a branch, for Windows commands and command
  names: new_branch_name, old_branch_name, old_ref_name, from, to, head,
  base, branch and new_branch;
- message of one file or several changed through the API, for system
  files and Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

internal/coreruleset/gitea.conf

@@ -1,8 +1,9 @@
 # The eighth change: on gitea's paths, some fields skip the rules that refused
 # ordinary gitea requests there. They are the fields where gitea sends a search,
-# a file name or a branch name. Each exclusion runs with the request, before the
-# rules it switches off, those of phase 1 included, so this file is loaded before
-# the Core Rule Set's rules. Each comment names a request the rule refused.
+# a file's name or text, a commit message or a branch name. Each exclusion runs
+# with the request, before the rules it switches off, those of phase 1 included,
+# so this file is loaded before the Core Rule Set's rules. Each comment names a
+# request the rule refused.
 
 # gitea's searches of code, of issues and pull requests, and of commits send the
 # text searched for in q, which skips these rules there:
@@ -315,6 +316,90 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/branches/edit$" \
 SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/lastcommit/" \
     "id:900633,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:refSubUrl"
 
+# The requests below name a file or a branch in a body field, which is read only
+# while SWW_WAF_BODY_LIMIT is set. Each field skips the rules that refused it.
+# Each field that names a branch skips these rules:
+#   932120: fix-powershell-module
+#   932260: feat/docker-support
+# None applies when the query has a parameter of the same name.
+
+# The web editor's save, new file, delete, upload, patch and cherry-pick. The
+# file's path, in tree_path, skips these rules:
+#   930120: .htaccess
+#   932120: scripts/install-script.sh
+#   932260: docker-compose.yml
+# The commit's summary, in commit_summary, skips these rules:
+#   930120: Remove .htaccess
+#   932120: Remove scripts/install-script.sh
+# The file's text or the patch, in content, skips one rule:
+#   932235: a line that starts with install
+# A new branch for the commit is named in new_branch_name.
+SecRule REQUEST_FILENAME \
+    "@rx ^/[^/]+/[^/]+/(?:_edit|_new|_delete|_upload|_diffpatch|_cherrypick)/" \
+    "id:900660,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:tree_path|commit_summary|content|new_branch_name)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=932120;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=932260;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=930120;ARGS:commit_summary,\
+        ctl:ruleRemoveTargetById=932120;ARGS:commit_summary,\
+        ctl:ruleRemoveTargetById=932235;ARGS:content,\
+        ctl:ruleRemoveTargetById=932120;ARGS:new_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:new_branch_name"
+
+# A branch created on the web, in new_branch_name.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/_new/" \
+    "id:900661,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:new_branch_name "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:new_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:new_branch_name"
+
+# A branch renamed on the web, in from and to.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/rename$" \
+    "id:900662,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:from,\
+        ctl:ruleRemoveTargetById=932260;ARGS:from,\
+        ctl:ruleRemoveTargetById=932120;ARGS:to,\
+        ctl:ruleRemoveTargetById=932260;ARGS:to"
+
+# A branch created through the API, in new_branch_name. It starts from the
+# branch in old_branch_name, or the branch, tag or commit in old_ref_name.
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/branches$" \
+    "id:900663,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:new_branch_name|old_branch_name|old_ref_name)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:json.new_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.new_branch_name,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.old_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.old_branch_name,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.old_ref_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.old_ref_name"
+
+# A pull request opened through the API, from the branch in head into the
+# branch in base.
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/pulls$" \
+    "id:900664,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:head|base)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:json.head,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.head,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.base,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.base"
+
+# One file or several created, changed or deleted through the API, on the branch
+# in branch. A new branch for the commit is named in new_branch. The commit's
+# message, in message, skips these rules:
+#   930120: Remove .htaccess
+#   932120: Add a PowerShell build script
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/contents(?:/|$)" \
+    "id:900665,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:branch|new_branch|message)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:json.branch,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.branch,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.new_branch,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.new_branch,\
+        ctl:ruleRemoveTargetById=930120;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.message"
+
 # An artifact upload from actions/upload-artifact@v3 sends the header
 # Content-Range, which the Core Rule Set refused (920450).
 SecRule REQUEST_FILENAME \