From f3ea0d4233f223fc8c9d870d428d75d05781527d Mon Sep 17 00:00:00 2001 From: clawbot Date: Wed, 11 Nov 2026 14:50:31 +0000 Subject: [PATCH] Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352) Recorded with python3, powershell, ls -la, .htaccess, file names and plain words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips 930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and Forgejo's /admin/ alike, and in the body of the admin forms that adopt a repository or activate an email. The issue and pull request searches of a team and of a milestone join 900600 and 900601, as a repository's do. A repository's packages page and the admin packages page join 900602, which also skips 944130. 900605, which lets /bin/sh through in q on branches and owner packages, now also covers the tags page and those two pages, since tag and package names can hold a slash. Model: opus-5-5 --- SPEC.md | 39 ++- internal/coreruleset/coreruleset_test.go | 4 +- internal/coreruleset/gitea.conf | 76 +++-- internal/coreruleset/gitea_test.go | 161 ++++++++++ .../coreruleset/testdata/forgejo-requests.txt | 293 ++++++++++++++++++ .../coreruleset/testdata/gitea-requests.txt | 279 +++++++++++++++++ 6 files changed, 822 insertions(+), 30 deletions(-) create mode 100644 internal/coreruleset/gitea_test.go diff --git a/SPEC.md b/SPEC.md index c98afe0..f8d1722 100644 --- a/SPEC.md +++ b/SPEC.md @@ -817,7 +817,10 @@ The changes hold in front of every app, and no setting undoes them: request it refused. The fields are: - `q` on gitea's searches of code, of issues and pull requests, and of commits. A code search holds code, such as `