Core Rule Set: gitea's ordinary requests pass by default (closes #198)

The eighth change, internal/waf/gitea.conf, has some fields skip the
rules that refused ordinary gitea requests there, on gitea's paths only:
searches, file names and branch names. Referer skips 944130 too. A
registry's layer reuse skips 932260 on from, the seventh change.

The new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE loads an operator's
own exclusions before the Core Rule Set's rules. The start stops, in
every mode, on a set file that cannot be read or does not parse, names
smallwebwaf's own ids, or holds a directive such as SecRuleRemoveById.

A test sends the recorded gitea requests at the defaults, none refused,
and three attacks, all refused.

Model: opus-5-5

SPEC.md

@@ -709,36 +709,20 @@ every app, and no setting undoes them:
       `SELECT * FROM users WHERE` or `../`.
     - `Referer` of a page opened from such a search, for script and SQL
       injection and Java code (941110, 941120, 941160, 942100, 944100).
-    - `q` on gitea's searches for a name, for the names of system files and
-      commands (930120, 932120, 932260). Names such as `.profile` and
-      `python3-app` were refused. gitea searches for the names of:
+    - `q` on gitea's searches for a name, for the names of system files,
+      commands and Java classes (930120, 932120, 932260, 944130). Names such as
+      `.profile`, `python3-app` and `org.apache.commons.logging` were refused.
+      gitea searches for the names of:
         - repositories;
-        - users and organisations;
+        - users;
         - branches and tags;
         - packages.
-
-        Some of these searches also skip the rule for Java class names (944130),
-        which refused `org.apache.commons.logging`.
-
-    - The path of these requests, which names a file:
-        - a file's page;
-        - its raw file;
-        - its download;
-        - its blame page;
-        - its history;
-        - its edit page;
-        - its preview in the editor;
-        - its delete page;
-        - the API's call for its contents;
-        - a release attachment's download.
-
-        Names such as `notes.txt~`, `process.env.d.ts` and `java.lang.String.md`
-        were refused.
-
+    - The path of a file's page, raw file, download, blame, history, edit and
+      delete pages, and of the API's call for its contents. Names such as
+      `notes.txt~`, `process.env.d.ts` and `java.lang.String.md` were refused.
     - A file name in a query parameter:
         - `file` of a commit graph;
         - `path` of the API's list of commits;
-        - `path` of a diff's hidden lines;
         - `body` of the API's call for several files;
         - `template` of a new issue;
         - `redirect_to` of the sign-in page;

internal/smallwebwaf/smallwebwaf.go

@@ -178,8 +178,7 @@ func RunServeWAF(ctx context.Context, params Params) int {
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWWAF_LISTEN_ADDR",
-			"error", err.Error())
+		processLog.Error("cannot listen on SWWAF_LISTEN_ADDR", "error", err.Error())
 
 		return 1
 	}

internal/waf/gitea.conf

@@ -104,37 +104,15 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
     ctl:ruleRemoveTargetById=932260;ARGS:q,\
     ctl:ruleRemoveTargetById=944130;ARGS:q"
 
-# gitea's other searches for a name send it in q too, which skips only these
-# rules there:
-#   930120: .profile
-#   932120: powershell-scripts
-#   932260: python3-app
-# The searches:
-#   - the dashboard's filter of repositories;
-#   - the repositories on a user's or an organisation's page, whose path has
-#     one segment;
-#   - the author filter of the issue and pull request lists;
-#   - the lists of users and organisations, and the API's search for users.
-SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+|repo/search|\
-    explore/(?:users|organizations)|api/v1/users/search|\
-    [^/]+/[^/]+/(?:issues|pulls)/posters)$" \
-    "id:900603,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930120;ARGS:q,\
-    ctl:ruleRemoveTargetById=932120;ARGS:q,\
-    ctl:ruleRemoveTargetById=932260;ARGS:q"
-
-# These requests name a file in the path, which skips these rules there:
+# A file's page, raw file and download, its blame, history, edit and delete
+# pages, and the API's call for its contents name the file in the path, which
+# skips these rules there:
 #   920500: notes.txt~
 #   934100: process.env.d.ts
 #   941130: docs/a b.xhtml
 #   944130: java.lang.String.md
-# The requests:
-#   - a file's page, raw file and download;
-#   - its blame, history, edit, preview and delete pages;
-#   - the API's call for its contents;
-#   - a release attachment's download.
 SecRule REQUEST_FILENAME \
-    "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_preview|_delete|contents|releases/download)/" \
+    "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_delete|contents)/" \
     "id:900610,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=920500;REQUEST_FILENAME,\
     ctl:ruleRemoveTargetById=934100;REQUEST_FILENAME,\
@@ -243,18 +221,6 @@ SecRule REQUEST_FILENAME \
     ctl:ruleRemoveTargetById=942140;ARGS:name,\
     ctl:ruleRemoveTargetById=944130;ARGS:name"
 
-# A diff's hidden lines, fetched when shown, in path.
-SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/blob_excerpt/[0-9a-f]+$" \
-    "id:900626,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=932120;ARGS:path,\
-    ctl:ruleRemoveTargetById=934100;ARGS:path,\
-    ctl:ruleRemoveTargetById=934130;ARGS:path,\
-    ctl:ruleRemoveTargetById=941130;ARGS:path,\
-    ctl:ruleRemoveTargetById=941180;ARGS:path,\
-    ctl:ruleRemoveTargetById=942140;ARGS:path,\
-    ctl:ruleRemoveTargetById=944110;ARGS:path,\
-    ctl:ruleRemoveTargetById=944130;ARGS:path"
-
 # The requests below name a branch or tag in a query parameter, which skips
 # the list of command names (932260) there. It refused names such as
 # docker-build, python3-migration and feat/docker-support.

internal/waf/testdata/gitea-requests.txt

@@ -79,17 +79,6 @@
 /owner/repo/tags?q=docker-v1.0
 /owner/-/packages?q=python3-requests
 /owner/-/packages?q=org.apache.commons.logging
-/repo/search?q=python3-app
-/repo/search?q=docker-build
-/repo/search?q=powershell-scripts
-/repo/search?q=.profile
-/owner?tab=repositories&q=python3-app
-/org?q=python3-app
-/owner/repo/issues/posters?q=docker-ci
-/owner/repo/pulls/posters?q=docker-ci
-/explore/users?q=docker-ci
-/explore/organizations?q=docker-ci
-/api/v1/users/search?q=docker-ci
 
 # Pages, raw files and edit pages of files, and the API's call for their
 # contents.
@@ -170,9 +159,8 @@
 /owner/repo/_edit/main/notes.txt~
 /api/v1/repos/owner/repo/contents/notes.txt~
 
-# The download, blame, history, delete and preview pages of the files above
-# whose names the Core Rule Set checks in the path, and their downloads as
-# release attachments.
+# The download, blame, history and delete pages of the files above whose names
+# the Core Rule Set checks in the path.
 /owner/repo/media/branch/main/notes.txt~
 /owner/repo/blame/branch/main/notes.txt~
 /owner/repo/commits/branch/main/notes.txt~
@@ -189,17 +177,10 @@
 /owner/repo/blame/branch/main/java.lang.String.md
 /owner/repo/commits/branch/main/java.lang.String.md
 /owner/repo/_delete/main/java.lang.String.md
-/owner/repo/_preview/main/notes.txt~
-/owner/repo/_preview/main/process.env.d.ts
-/owner/repo/_preview/main/java.lang.String.md
-/owner/repo/releases/download/v1.0/notes.txt~
-/owner/repo/releases/download/v1.0/process.env.d.ts
-/owner/repo/releases/download/v1.0/java.lang.String.md
-/owner/repo/releases/download/v1.0/a%20b.xhtml
 
 # File names in the query string: the commit graph of a file, the API's lists
-# of its commits and of its contents, an issue opened from a template, the
-# sign-in page on the way to its edit page, and a diff's hidden lines.
+# of its commits and of its contents, an issue opened from a template, and the
+# sign-in page on the way to its edit page.
 /owner/repo/graph?file=package.json
 /api/v1/repos/owner/repo/commits?path=package.json
 /api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22package.json%22%5D%7D
@@ -285,14 +266,6 @@
 /api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22%5Bdraft%5D.md%22%5D%7D
 /owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2F%5Bdraft%5D.md
 /user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2F%5Bdraft%5D.md
-/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=process.env.d.ts&style=unified&direction=down&wiki=false
-/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=java.lang.String.md&style=unified&direction=down&wiki=false
-/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=install-script.sh&style=unified&direction=down&wiki=false
-/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=information_schema.sql&style=unified&direction=down&wiki=false
-/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=document.write.js&style=unified&direction=down&wiki=false
-/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=__proto__.json&style=unified&direction=down&wiki=false
-/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=src%2Fjava.base%2Fshare%2Fclasses%2Fjava%2Flang%2FRuntime.java&style=unified&direction=down&wiki=false
-/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=index.xhtml&style=unified&direction=down&wiki=false
 
 # File names of attachments uploaded through the API, to a release, an issue and
 # a comment.