script/gitea-requests, and the gitea refusals it confirms named in SPEC.md (closes #30)

script/gitea-requests runs gitea 1.27.3 behind the image at its
defaults, sends through it the requests that reading gitea's source
found the Core Rule Set refuses, with a short sample of ordinary use,
and prints each request with the rule ids that matched it. make
gitea-requests runs it; make check does not.

Every case still holds, and each fix would let through what SPEC.md
says stays refused, so the notes specific to gitea now name them with
how each refusal plays out: file names in query parameters that read as
Java, script, PowerShell or SQL, such paths, and an image push that
reuses a layer of an image named like a command.

Model: opus-5-5

README.md

@@ -2376,17 +2376,19 @@ so that they run in minimal containers.
   cache, and `script/check` does not run it; `make example-app` does.
 - `script/gitea-requests`: builds the image and runs gitea 1.27.3 behind it,
   with every setting of `smallwebwaf` at its default but `SWWAF_UPSTREAM_URL`,
-  which names gitea's container. It sends through it the gitea requests that the
-  notes specific to gitea in [`SPEC.md`](SPEC.md) name for a file name in a
-  query parameter, for a path and for a container image push, and a short sample
-  of gitea's ordinary use: signing in, pages of files and commits, a diff, the
-  API, a push, clone and fetch over HTTP, and two container image pushes. It
-  prints a line for each request `smallwebwaf` logged, with what it did with it
-  and the ids of the Core Rule Set's rules that matched it, then removes the
-  containers, the network and the images it made, but gitea's own image. It
-  needs network access, and a docker daemon that pushes to a registry on
-  `localhost` over plain HTTP, as docker does by default; `script/check` does
-  not run it, and `make gitea-requests` does.
+  which names gitea's container. It sends through it the gitea requests that
+  three of the notes specific to gitea in [`SPEC.md`](SPEC.md) name: a file name
+  in a query parameter that the Core Rule Set takes for Java, script, PowerShell
+  or SQL, a path it takes for a Java class or Node.js code or that has a
+  directory named `...`, and a container image push that reuses a layer. It also
+  sends a short sample of gitea's ordinary use: signing in, pages of files and
+  commits, a diff, the API, a push, clone and fetch over HTTP, and two container
+  image pushes. It prints a line for each request `smallwebwaf` logged, with
+  what it did with it and the ids of the Core Rule Set's rules that matched it,
+  then removes the containers, the network and the images it made, but gitea's
+  own image. It needs network access, and a docker daemon that pushes to a
+  registry on `localhost` over plain HTTP, as docker does by default;
+  `script/check` does not run it, and `make gitea-requests` does.
 
 ## TODO
 

SPEC.md

@@ -1510,9 +1510,13 @@ holds any token file.
           starts with an entry on the list of commands (932260), such as
           `owner/python3-app` or `owner/docker-base`. docker asks gitea to take
           the layer from that image, naming it in the query parameter `from`,
-          which 932260 checks. The push fails with the 403 answer of
-          `smallwebwaf`, and so does each new try, since docker asks in the same
-          way.
+          which 932260 checks, and gets the 403 answer of `smallwebwaf`. A
+          docker that keeps its images in containerd's image store, as a new
+          install of Docker Engine 29 does, then fails the push, and fails each
+          new try the same way. A docker that keeps them in its own older image
+          store uploads the layer instead, so the push succeeds after one
+          refusal for each layer it reuses, and each of those refusals counts
+          toward the error burst.
     - Artifact uploads from `actions/upload-artifact@v3` send the header
       `Content-Range`, which the Core Rule Set refuses (920450). The action
       sends two files at a time, does not retry a 403 and sends no further file
@@ -1601,11 +1605,13 @@ holds any token file.
   body once `SWWAF_WAF_BODY_LIMIT` is set): a match refuses only that request
   and bans no one by itself; the request log names the rule, and exclusions by
   rule id and path fix it. `script/gitea-requests` runs gitea behind the image
-  at the defaults, sends through it the requests the notes specific to gitea
-  name for a file name in a query parameter, for a path and for a container
-  image push, and a short sample of gitea's ordinary use, and reports each
-  request the Core Rule Set refuses, so that those notes can be checked again
-  when gitea or the Core Rule Set changes version.
+  at the defaults and sends through it a short sample of gitea's ordinary use
+  and the requests that three of the notes specific to gitea name: a file name
+  in a query parameter that the Core Rule Set takes for Java, script, PowerShell
+  or SQL, a path it takes for a Java class or Node.js code or that has a
+  directory named `...`, and a container image push that reuses a layer. It
+  reports each request the Core Rule Set refuses, so that those three notes can
+  be checked again when gitea or the Core Rule Set changes version.
 - Attacks carried in request bodies: not refused by default, since on a code
   forge bodies are full of code the Core Rule Set takes for attacks. Most of
   what shows in URLs and headers is still refused, the client that sends an

script/gitea-requests

@@ -9,11 +9,12 @@
 # did with it and the ids of the Core Rule Set's rules that matched it.
 # Every request comes from one client, docker's gateway, so more than
 # SWWAF_ERROR_BURST_THRESHOLD, 30, refusals in a minute would ban it, and
-# the requests after would show as banned. The containers, the network, the images and the files the script makes
-# are removed however it ends; gitea's own image stays, as the base images
-# of a build do. It needs network access, and a docker daemon that pushes
-# to a registry on localhost over plain HTTP, as docker does by default.
-# script/check does not run this.
+# the requests after would show as banned. The containers, the network,
+# the images and the files the script makes are removed however it ends;
+# gitea's own image stays, as the base images of a build do. It needs
+# network access, and a docker daemon that pushes to a registry on
+# localhost over plain HTTP, as docker does by default. script/check does
+# not run this.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"