Core Rule Set: Forgejo's ordinary requests pass by default (closes #342)

Forgejo 17.0.1's recorded requests are in
testdata/forgejo-requests.txt, checked at the defaults.

What Forgejo sends and gitea does not:
- its flash cookie is named flash, which joins gitea_flash among the
  cookies left out;
- its wiki search, whose q skips five rules in forgejo.conf, the
  fifteenth change.

Gaps in gitea's fixes the recording showed: q on the name searches
skips 932250 (ls -la), and the API's package search is one of them.
User and organisation pages, any one-segment path, keep 932250.

Model: opus-5-5

README.md

@@ -589,8 +589,8 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
       through. On gitea's own paths, its searches, file names and branch names
       do too.
     - Forgejo: git over HTTP and its container and package registries get
-      through. On Forgejo's own paths, its searches, wiki searches included,
-      file names and branch names do too.
+      through. On Forgejo's own paths, its searches, file names and branch names
+      do too.
     - WordPress: saving a post from the block editor gets through. On
       WordPress's own paths, its searches, names and file names do too.
     - Drupal: on Drupal's own paths, the page to return to, its searches and its

SPEC.md

@@ -819,18 +819,19 @@ The changes hold in front of every app, and no setting undoes them:
       `SELECT * FROM users WHERE` or `../`.
     - `Referer` of a page opened from such a search, for script and SQL
       injection and Java code (941110, 941120, 941160, 942100, 944100).
-    - `q` on gitea's searches for a name, for the names of system files and
-      commands, and for a listing of files (930120, 932120, 932250, 932260).
-      Names such as `.profile` and `python3-app`, and the words `ls -la`, were
-      refused. gitea searches for the names of:
+    - `q` on gitea's searches for a name, for the lists of system files and
+      command names (930120, 932120, 932250, 932260). Names such as `.profile`
+      and `python3-app`, and the words `ls -la`, were refused. gitea searches
+      for the names of:
         - repositories;
         - users and organisations;
         - branches and tags;
         - packages, on its pages and in its API.
 
         A user's or an organisation's page is any path of one segment, so on
-        every such path, on any app, `q` skips these rules, for example on
-        `/search`. It keeps 932250 there, so `ls -la` is refused on those pages.
+        every such path, on any app, `q` skips 930120, 932120 and 932260, for
+        example on `/search`. It keeps 932250 there, so `ls -la` is refused on
+        those pages.
 
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.
@@ -1577,7 +1578,7 @@ The changes hold in front of every app, and no setting undoes them:
     - system files (930120), such as `.htaccess`;
     - Windows commands (932120), such as `powershell`;
     - shell paths (932160), such as `/bin/sh`;
-    - a listing of files (932250), such as `ls -la`;
+    - Unix commands (932250), such as `ls -la`;
     - command names (932260), such as `python3`.
 
     `; wget http://example.com/x.sh`, path traversal, and SQL and script

internal/coreruleset/coreruleset_test.go

@@ -370,7 +370,7 @@ func TestParameterNamesAreMatchedWithoutRegardToCase(t *testing.T) {
 		get("/?next=http://127.0.0.1:52341/"), matched(931100, 934110))
 }
 
-func TestCookiesGiteaFlashFlashAndRedirectToAreNotRead(t *testing.T) {
+func TestFlashAndRedirectToCookiesAreNotRead(t *testing.T) {
 	t.Parallel()
 
 	const (

internal/coreruleset/forgejo_test.go

@@ -2,6 +2,7 @@ package coreruleset_test
 
 import (
 	"net/http"
+	"slices"
 	"testing"
 )
 
@@ -49,3 +50,29 @@ func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
 		}
 	}
 }
+
+func TestForgejoExclusionsAreNarrow(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := atDefaults(t)
+
+	// /bin/sh and the hard values, which q lets through on the wiki's
+	// search, stay refused in q on paths near it and in another field on it.
+	// /alice/wiki/search would be the code search of a repository named
+	// wiki, where the eighth change lets q through. Forgejo has no owner
+	// named api, so /api/wiki/search is not one.
+	for _, target := range []string{
+		"/alice/tools/wiki/Home?q=",
+		"/alice/tools/wiki/search/x?q=",
+		"/api/wiki/search?q=",
+		"/alice/tools/wiki/search?other=",
+	} {
+		for _, value := range slices.Concat([]string{"%2Fbin%2Fsh"}, hardValues) {
+			if got := inspect(t, crs, get(target+value)); got.Score < threshold {
+				t.Errorf("%s%s let through: %+v", target, value, got)
+			}
+		}
+	}
+}