Core Rule Set: gitea's ordinary requests pass by default (closes #198)

The eighth change, internal/waf/gitea.conf, has some fields skip the
rules that refused ordinary gitea requests there, on gitea's paths only:
searches, file names and branch names. Referer skips 944130 too. A
registry's layer reuse skips 932260 on from, the seventh change.

The new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE loads an operator's
own exclusions before the Core Rule Set's rules. The start stops, in
every mode, on a set file that cannot be read or does not parse, names
smallwebwaf's own ids, or holds a directive such as SecRuleRemoveById.

A test sends the recorded gitea requests at the defaults, none refused,
and three attacks, all refused.

Model: opus-5-5

SPEC.md

@@ -709,20 +709,36 @@ every app, and no setting undoes them:
       `SELECT * FROM users WHERE` or `../`.
     - `Referer` of a page opened from such a search, for script and SQL
       injection and Java code (941110, 941120, 941160, 942100, 944100).
-    - `q` on gitea's searches for a name, for the names of system files,
+    - `q` on gitea's searches for a name, for the names of system files and
-      commands and Java classes (930120, 932120, 932260, 944130). Names such as
+      commands (930120, 932120, 932260). Names such as `.profile` and
-      `.profile`, `python3-app` and `org.apache.commons.logging` were refused.
+      `python3-app` were refused. gitea searches for the names of:
-      gitea searches for the names of:
         - repositories;
-        - users;
+        - users and organisations;
         - branches and tags;
         - packages.
-    - The path of a file's page, raw file, download, blame, history, edit and
+
-      delete pages, and of the API's call for its contents. Names such as
+        Some of these searches also skip the rule for Java class names (944130),
-      `notes.txt~`, `process.env.d.ts` and `java.lang.String.md` were refused.
+        which refused `org.apache.commons.logging`.
+
+    - The path of these requests, which names a file:
+        - a file's page;
+        - its raw file;
+        - its download;
+        - its blame page;
+        - its history;
+        - its edit page;
+        - its preview in the editor;
+        - its delete page;
+        - the API's call for its contents;
+        - a release attachment's download.
+
+        Names such as `notes.txt~`, `process.env.d.ts` and `java.lang.String.md`
+        were refused.
+
     - A file name in a query parameter:
         - `file` of a commit graph;
         - `path` of the API's list of commits;
+        - `path` of a diff's hidden lines;
         - `body` of the API's call for several files;
         - `template` of a new issue;
         - `redirect_to` of the sign-in page;

internal/smallwebwaf/smallwebwaf.go

@@ -178,7 +178,8 @@ func RunServeWAF(ctx context.Context, params Params) int {
 
 	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
 	if err != nil {
-		processLog.Error("cannot listen on SWWAF_LISTEN_ADDR", "error", err.Error())
+		processLog.Error("cannot listen on SWWAF_LISTEN_ADDR",
+			"error", err.Error())
 
 		return 1
 	}

internal/waf/gitea.conf

@@ -104,15 +104,37 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
     ctl:ruleRemoveTargetById=932260;ARGS:q,\
     ctl:ruleRemoveTargetById=944130;ARGS:q"
 
-# A file's page, raw file and download, its blame, history, edit and delete
+# gitea's other searches for a name send it in q too, which skips only these
-# pages, and the API's call for its contents name the file in the path, which
+# rules there:
-# skips these rules there:
+#   930120: .profile
+#   932120: powershell-scripts
+#   932260: python3-app
+# The searches:
+#   - the dashboard's filter of repositories;
+#   - the repositories on a user's or an organisation's page, whose path has
+#     one segment;
+#   - the author filter of the issue and pull request lists;
+#   - the lists of users and organisations, and the API's search for users.
+SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+|repo/search|\
+    explore/(?:users|organizations)|api/v1/users/search|\
+    [^/]+/[^/]+/(?:issues|pulls)/posters)$" \
+    "id:900603,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932260;ARGS:q"
+
+# These requests name a file in the path, which skips these rules there:
 #   920500: notes.txt~
 #   934100: process.env.d.ts
 #   941130: docs/a b.xhtml
 #   944130: java.lang.String.md
+# The requests:
+#   - a file's page, raw file and download;
+#   - its blame, history, edit, preview and delete pages;
+#   - the API's call for its contents;
+#   - a release attachment's download.
 SecRule REQUEST_FILENAME \
-    "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_delete|contents)/" \
+    "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_preview|_delete|contents|releases/download)/" \
     "id:900610,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=920500;REQUEST_FILENAME,\
     ctl:ruleRemoveTargetById=934100;REQUEST_FILENAME,\
@@ -221,6 +243,18 @@ SecRule REQUEST_FILENAME \
     ctl:ruleRemoveTargetById=942140;ARGS:name,\
     ctl:ruleRemoveTargetById=944130;ARGS:name"
 
+# A diff's hidden lines, fetched when shown, in path.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/blob_excerpt/[0-9a-f]+$" \
+    "id:900626,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=932120;ARGS:path,\
+    ctl:ruleRemoveTargetById=934100;ARGS:path,\
+    ctl:ruleRemoveTargetById=934130;ARGS:path,\
+    ctl:ruleRemoveTargetById=941130;ARGS:path,\
+    ctl:ruleRemoveTargetById=941180;ARGS:path,\
+    ctl:ruleRemoveTargetById=942140;ARGS:path,\
+    ctl:ruleRemoveTargetById=944110;ARGS:path,\
+    ctl:ruleRemoveTargetById=944130;ARGS:path"
+
 # The requests below name a branch or tag in a query parameter, which skips
 # the list of command names (932260) there. It refused names such as
 # docker-build, python3-migration and feat/docker-support.

internal/waf/testdata/gitea-requests.txt

@@ -79,6 +79,17 @@
 /owner/repo/tags?q=docker-v1.0
 /owner/-/packages?q=python3-requests
 /owner/-/packages?q=org.apache.commons.logging
+/repo/search?q=python3-app
+/repo/search?q=docker-build
+/repo/search?q=powershell-scripts
+/repo/search?q=.profile
+/owner?tab=repositories&q=python3-app
+/org?q=python3-app
+/owner/repo/issues/posters?q=docker-ci
+/owner/repo/pulls/posters?q=docker-ci
+/explore/users?q=docker-ci
+/explore/organizations?q=docker-ci
+/api/v1/users/search?q=docker-ci
 
 # Pages, raw files and edit pages of files, and the API's call for their
 # contents.
@@ -159,8 +170,9 @@
 /owner/repo/_edit/main/notes.txt~
 /api/v1/repos/owner/repo/contents/notes.txt~
 
-# The download, blame, history and delete pages of the files above whose names
+# The download, blame, history, delete and preview pages of the files above
-# the Core Rule Set checks in the path.
+# whose names the Core Rule Set checks in the path, and their downloads as
+# release attachments.
 /owner/repo/media/branch/main/notes.txt~
 /owner/repo/blame/branch/main/notes.txt~
 /owner/repo/commits/branch/main/notes.txt~
@@ -177,10 +189,17 @@
 /owner/repo/blame/branch/main/java.lang.String.md
 /owner/repo/commits/branch/main/java.lang.String.md
 /owner/repo/_delete/main/java.lang.String.md
+/owner/repo/_preview/main/notes.txt~
+/owner/repo/_preview/main/process.env.d.ts
+/owner/repo/_preview/main/java.lang.String.md
+/owner/repo/releases/download/v1.0/notes.txt~
+/owner/repo/releases/download/v1.0/process.env.d.ts
+/owner/repo/releases/download/v1.0/java.lang.String.md
+/owner/repo/releases/download/v1.0/a%20b.xhtml
 
 # File names in the query string: the commit graph of a file, the API's lists
-# of its commits and of its contents, an issue opened from a template, and the
+# of its commits and of its contents, an issue opened from a template, the
-# sign-in page on the way to its edit page.
+# sign-in page on the way to its edit page, and a diff's hidden lines.
 /owner/repo/graph?file=package.json
 /api/v1/repos/owner/repo/commits?path=package.json
 /api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22package.json%22%5D%7D
@@ -266,6 +285,14 @@
 /api/v1/repos/owner/repo/file-contents?body=%7B%22files%22%3A%5B%22%5Bdraft%5D.md%22%5D%7D
 /owner/repo/issues/new?template=.gitea%2FISSUE_TEMPLATE%2F%5Bdraft%5D.md
 /user/login?redirect_to=%2Fowner%2Frepo%2F_edit%2Fmain%2F%5Bdraft%5D.md
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=process.env.d.ts&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=java.lang.String.md&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=install-script.sh&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=information_schema.sql&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=document.write.js&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=__proto__.json&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=src%2Fjava.base%2Fshare%2Fclasses%2Fjava%2Flang%2FRuntime.java&style=unified&direction=down&wiki=false
+/owner/repo/blob_excerpt/0123456789abcdef0123456789abcdef01234567?last_left=10&last_right=10&left=20&right=20&left_hunk_size=5&right_hunk_size=5&path=index.xhtml&style=unified&direction=down&wiki=false
 
 # File names of attachments uploaded through the API, to a release, an issue and
 # a comment.