Core Rule Set: ls -la passes in q on a gitea user's or organisation's page (closes #349)

On a path of one segment made of the characters a user's or an
organisation's name may hold, q now skips 932250 too, unless the path
ends in a server-side script's extension, such as .php or .cgi. The
searches on a user's and an organisation's page are recorded from gitea
1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

SPEC.md

@@ -830,9 +830,12 @@ The changes hold in front of every app, and no setting undoes them:
 
         A user's or an organisation's page has a path of one segment, such as
         `/alice`. So on any app, `q` skips these rules on every path of one
-        segment, such as `/search`. Such a path keeps 932250 when it ends in a
-        server-side script's extension, such as `/index.php`, so `ls -la` is
-        refused there. The extensions are these, in upper or lower case:
+        segment, such as `/search`. But it skips 932250 only on a path made of
+        the characters a name may hold: letters, digits, `-`, `_` and dots, the
+        first a letter or digit. So `ls -la` is refused on
+        `/login.jsp;jsessionid=abc`. `q` also keeps 932250 on a path that ends
+        in a server-side script's extension, such as `/index.php`. The
+        extensions are these, in upper or lower case:
         - `.php`;
         - `.phtml`;
         - `.php5`;

internal/coreruleset/coreruleset_test.go

@@ -1078,12 +1078,14 @@ func TestGiteaSearchOnAUsersOrAnOrganisationsPageLetsLsThrough(t *testing.T) {
 	}
 
 	// 932250 still applies on a path that ends in a server-side script's
-	// extension, to another field, and on a path of two segments.
+	// extension or holds a character no name holds, to another field, and on
+	// a path of two segments.
 	for _, target := range []string{
 		"/index.php?q=ls%20-la",
 		"/INDEX.PHP?q=ls%20-la",
 		"/index%2Ephp?q=ls%20-la",
 		"/search.cgi?q=ls%20-la",
+		"/login.jsp;jsessionid=abc?q=ls%20-la",
 		"/alice?tab=ls%20-la",
 		"/alice/tools?q=ls%20-la",
 	} {

internal/coreruleset/gitea.conf

@@ -146,9 +146,12 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
-# On those pages q skips 932250 too, which refused ls -la. A path keeps it when
-# it ends in a server-side script's extension, such as /index.php or /search.cgi.
-SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
+# On those pages q skips 932250 too, which refused ls -la, but only on a path
+# made of the characters a user's or an organisation's name may hold. Those are
+# letters, digits, -, _ and dots, the first a letter or digit, so
+# /login.jsp;jsessionid=abc keeps 932250. A path that ends in a server-side
+# script's extension keeps it too, such as /index.php or /search.cgi.
+SecRule REQUEST_FILENAME "@rx ^/[0-9A-Za-z][-.\w]*$" \
     "id:900606,phase:1,pass,nolog,chain"
     SecRule REQUEST_FILENAME "!@rx \.(?:php|phtml|php5|cgi|pl|py|asp|aspx|jsp)$" \
         "t:lowercase,ctl:ruleRemoveTargetById=932250;ARGS:q"