SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

Each app's fixes are one .conf file and one entry in apps. They apply
only while Inspect has set the app's transaction variable, such as
tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only
its apps' fixes; while SWW_APPS is unset, every hostname gets every
app's fixes. Listing forgejo, a fork of gitea, brings gitea's fixes too.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

internal/coreruleset/forgejo_test.go

@@ -4,15 +4,59 @@ import (
 	"net/http"
 	"slices"
 	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
+// forgejo is Forgejo's name in SWW_APPS.
+const forgejo = "forgejo"
+
+// forgejoHost is the hostname of the tests of SWW_APPS that serves Forgejo.
+const forgejoHost = "code.example"
+
+func TestForgejoFixesApplyOnlyToAHostnameThatServesForgejo(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{
+		forgejoHost: {forgejo}, otherHost: {wordpress},
+	})
+
+	// A search of a wiki, a search of the admin page, and a file name in
+	// Forgejo's flash cookie, which only Forgejo's fixes let through.
+	for _, fixed := range []struct {
+		request request
+		result  coreruleset.Result
+	}{
+		{get("/alice/tools/wiki/search?q=python3"), matched(932260)},
+		{get("/admin/repos?q=python3"), matched(932260)},
+		{
+			get("/alice/tools", "Cookie: flash=success%3DFile%2Bpackage.json%2Bdeleted"),
+			matched(930120),
+		},
+	} {
+		wantResult(t, crs, withHost(fixed.request, forgejoHost), coreruleset.Result{})
+		wantResult(t, crs, withHost(fixed.request, otherHost), fixed.result)
+	}
+}
+
+func TestHostnameListingForgejoGetsGiteasFixesToo(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{forgejoHost: {forgejo}})
+
+	for _, fixed := range giteaFixed {
+		wantResult(t, crs, withHost(fixed.request, forgejoHost), coreruleset.Result{})
+	}
+}
+
 // forgejoSearches are Forgejo's searches whose q skips some rules: the
-// wiki's, from the fifteenth change, and the searches for a name, from the
-// eighth.
+// wiki's and the admin page's, from Forgejo's fixes, and the searches for a
+// name, from gitea's.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
 var forgejoSearches = []string{
 	"/alice/tools/wiki/search",
+	"/admin/repos",
 	"/explore/repos",
 	"/explore/users",
 	"/alice/tools/branches",
@@ -61,7 +105,7 @@ func TestForgejoExclusionsAreNarrow(t *testing.T) {
 	// /bin/sh and the hard values, which q lets through on the wiki's
 	// search, stay refused in q on paths near it and in another field on it.
 	// /alice/wiki/search would be the code search of a repository named
-	// wiki, where the eighth change lets q through. Forgejo has no owner
+	// wiki, where gitea's fixes let q through. Forgejo has no owner
 	// named api, so /api/wiki/search is not one.
 	for _, target := range []string{
 		"/alice/tools/wiki/Home?q=",