Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352)
check / check (push) Failing after 1m18s
check / check (push) Failing after 1m18s
Recorded with python3, powershell, ls -la, .htaccess, file names and plain words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips 930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and Forgejo's /admin/ alike, and in the body of the admin forms that adopt a repository or activate an email. The issue and pull request searches of a team and of a milestone join 900600 and 900601, as a repository's do. A repository's packages page and the admin packages page join 900602, which also skips 944130. 900605, which lets /bin/sh through in q on branches and owner packages, now also covers the tags page and those two pages, since tag and package names can hold a slash. Model: opus-5-5
This commit is contained in:
clawbot committed
1 parent
63e58e326b
commit
f3ea0d4233
6 files changed
+822
-30
No files matched your search
@@ -35,17 +35,20 @@
|
||||
# 944100: java.lang.Runtime
|
||||
# 944110: java.lang.Runtime
|
||||
# 944130: java.lang.Runtime
|
||||
# gitea has no owner named api. A repository's search, issues, pull requests and
|
||||
# commit search with that owner get none of this. /api/v2/search, for example,
|
||||
# is Mastodon's search.
|
||||
# The searches of issues and pull requests include those of one team of an
|
||||
# organisation, such as /org/acme/issues/developers, and of one milestone, such
|
||||
# as /alice/tools/milestone/1.
|
||||
# gitea has no owner named api. A repository's search, issues, pull requests,
|
||||
# milestone pages and commit search with that owner get none of this.
|
||||
# /api/v2/search, for example, is Mastodon's search.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
|
||||
[^/]+/-/code|\
|
||||
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
|
||||
[^/]+/-/code|org/[^/]+/(?:issues|pulls)/[^/]+|\
|
||||
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|milestone/[0-9]+|\
|
||||
commits/(?:branch|tag|commit)/.+/search)|\
|
||||
api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))$" \
|
||||
"id:900600,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/(?:search|issues(?:/search)?|\
|
||||
pulls|commits/(?:branch|tag|commit)/.+/search)$" \
|
||||
pulls|milestone/[0-9]+|commits/(?:branch|tag|commit)/.+/search)$" \
|
||||
"ctl:ruleRemoveTargetById=930110;ARGS:q,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
||||
ctl:ruleRemoveTargetById=931100;ARGS:q,\
|
||||
@@ -85,13 +88,14 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
|
||||
# 944100: java.lang.Runtime
|
||||
# A repository with the owner api is left out here too.
|
||||
SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
|
||||
issues(?:/search)?|pulls|[^/]+/-/code|\
|
||||
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
|
||||
issues(?:/search)?|pulls|[^/]+/-/code|org/[^/]+/(?:issues|pulls)/[^/]+|\
|
||||
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|milestone/[0-9]+|\
|
||||
commits/(?:branch|tag|commit)/.+/search)|\
|
||||
api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))\?" \
|
||||
"id:900601,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/[^/]+/(?:search|\
|
||||
issues(?:/search)?|pulls|commits/(?:branch|tag|commit)/.+/search)\?" \
|
||||
issues(?:/search)?|pulls|milestone/[0-9]+|\
|
||||
commits/(?:branch|tag|commit)/.+/search)\?" \
|
||||
"ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
|
||||
ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
|
||||
ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
|
||||
@@ -105,9 +109,12 @@ SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
|
||||
# 932250: ls -la
|
||||
# 932260: python3-app
|
||||
# 944130: org.apache.commons.logging
|
||||
# [^/]+/[^/]+/packages matches an owner's packages page (/alice/-/packages), a
|
||||
# repository's (/alice/tools/packages) and gitea's admin page of packages
|
||||
# (/-/admin/packages). Forgejo's admin page of packages is /admin/packages.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
|
||||
[^/]+/-/packages|[^/]+/[^/]+/(?:branches|tags)|api/v1/repos/search|\
|
||||
api/v1/packages/[^/]+)$" \
|
||||
[^/]+/[^/]+/(?:branches|tags|packages)|admin/packages|\
|
||||
api/v1/repos/search|api/v1/packages/[^/]+)$" \
|
||||
"id:900602,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
||||
@@ -115,26 +122,49 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:q,\
|
||||
ctl:ruleRemoveTargetById=944130;ARGS:q"
|
||||
|
||||
# A branch or package name can hold a slash, as feat/docker-support and npm's
|
||||
# @scope/name do. So q on a repository's branches page and on an owner's
|
||||
# packages page also skips this rule:
|
||||
# A branch, tag or package name can hold a slash, as feat/docker-support and
|
||||
# npm's @scope/name do. So q on a repository's branches, tags and packages
|
||||
# pages, on an owner's packages page and on the admin page of packages also
|
||||
# skips this rule:
|
||||
# 932160: /bin/sh
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/-/packages|[^/]+/[^/]+/branches)$" \
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
|
||||
admin/packages)$" \
|
||||
"id:900605,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932160;ARGS:q"
|
||||
|
||||
# gitea's other searches for a name send it in q too, which skips only these
|
||||
# rules there:
|
||||
# 930120: .profile
|
||||
# 932120: powershell-scripts
|
||||
# gitea's other searches send a name or a few words in q too, which skips only
|
||||
# these rules there:
|
||||
# 930120: .profile, .htaccess
|
||||
# 932120: powershell-scripts, powershell
|
||||
# 932250: ls -la
|
||||
# 932260: python3-app
|
||||
# 932260: python3-app, python3
|
||||
# The searches:
|
||||
# - the dashboard's filter of repositories;
|
||||
# - the author filter of the issue and pull request lists;
|
||||
# - the lists of users and organisations, and the API's search for users.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|\
|
||||
# - the lists of users and organisations, and the API's search for users;
|
||||
# - the list of repositories a user watches;
|
||||
# - an organisation's milestones of one team, and its search for teams;
|
||||
# - the milestones of a repository or an organisation, and the projects of a
|
||||
# repository, a user or an organisation;
|
||||
# - the versions of a package;
|
||||
# - the issues suggested when an issue is mentioned;
|
||||
# - the runner lists of the site, a user, an organisation and a repository;
|
||||
# - the admin lists of users, organisations, repositories, unadopted
|
||||
# repositories and emails, and the forms on them that adopt a repository or
|
||||
# activate an email, in the body.
|
||||
# gitea serves its admin pages under /-/admin/ and Forgejo under /admin/.
|
||||
# [^/]+/[^/]+/projects matches the projects page of a user or an organisation
|
||||
# (/alice/-/projects) as well as a repository's. The path of a package's
|
||||
# versions holds the package's name, which can hold a slash, as npm's
|
||||
# @scope/name does.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|notifications/watching|\
|
||||
explore/(?:users|organizations)|api/v1/users/search|\
|
||||
[^/]+/[^/]+/(?:issues|pulls)/posters)$" \
|
||||
org/[^/]+/(?:milestones/[^/]+|teams/-/search)|\
|
||||
[^/]+/-/packages/[^/]+/.+/versions|\
|
||||
[^/]+/[^/]+/(?:(?:issues|pulls)/posters|issues/suggestions|milestones|\
|
||||
projects|settings/actions/runners)|\
|
||||
user/settings/actions/runners|\
|
||||
(?:-/)?admin/(?:users|orgs|repos|repos/unadopted|emails|emails/activate|\
|
||||
actions/runners))$" \
|
||||
"id:900603,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
||||
|
||||
Reference in new issue
Block a user