Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352)

Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips
930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and
Forgejo's /admin/ alike, and in the body of the admin forms that adopt a
repository or activate an email. 900605, which lets /bin/sh through in q on
branches and owner packages, now also covers the tags page, a repository's
packages page and the admin packages page, since tag and package names can
hold a slash.

Model: opus-5-5

SPEC.md

@@ -827,10 +827,7 @@ The changes hold in front of every app, and no setting undoes them:
         - repositories;
         - users and organisations;
         - branches and tags;
-        - packages, in its API and on these pages:
-            - an owner's packages page;
-            - a repository's packages page;
-            - the admin page of packages.
+        - packages, on its pages and in its API.
 
         A user's or an organisation's page has a path of one segment, such as
         `/alice`. So on any app, `q` skips these rules on every path of one
@@ -869,12 +866,12 @@ The changes hold in front of every app, and no setting undoes them:
         - the milestones and projects of a repository, a user or an
           organisation;
         - the issues of one milestone;
-        - the versions of a package;
+        - a repository's packages, and the versions of a package;
         - the issues suggested when an issue is mentioned;
         - the runner lists of the site, a user, an organisation and a
           repository;
         - the admin lists of users, organisations, repositories, unadopted
-          repositories and emails.
+          repositories, emails and packages.
 
         Most send `q` in the query string. The admin forms that adopt a
         repository or activate an email send it in the body. gitea serves its

internal/config/rproxy.go

@@ -48,17 +48,7 @@ type RProxy struct {
 	settings []slog.Attr
 }
 
-// defaultUpstreamURL is the default of SWRP_UPSTREAM_URL.
-const defaultUpstreamURL = "http://127.0.0.1:8081"
-
-// privateRanges are the private address ranges, the default trusted
-// proxies.
-const privateRanges = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
-
 var (
-	errNotUpstreamURL = errors.New(
-		"is not a URL with only a scheme, a host and an optional port, " +
-			"such as http://127.0.0.1:8081")
 	errNeedsWAFBackend = errors.New(
 		"is required: it is waf's URL, such as http://waf:8080")
 	errNotDisposition  = errors.New("is not allow or deny")
@@ -134,14 +124,6 @@ func (c *RProxy) LogValue() slog.Value {
 	return slog.GroupValue(c.settings...)
 }
 
-// appURL reads a setting that is the app's URL.
-func (e *environment) appURL(name, defaultValue string) *url.URL {
-	upstream, err := parseUpstreamURL(e.value(name, defaultValue))
-	e.check(name, err)
-
-	return upstream
-}
-
 // wafBackend reads the setting that is waf's URL, which must be set.
 func (e *environment) wafBackend(name string) *url.URL {
 	value := e.value(name, "")
@@ -208,32 +190,3 @@ func parseMilliseconds(value string) (time.Duration, bool) {
 
 	return time.Duration(n) * time.Millisecond, true
 }
-
-// parseUpstreamURL reads the app's URL: http or https, a host and an
-// optional port from 1 to 65535, and nothing else, since the request's
-// own path and query go to the app unchanged.
-func parseUpstreamURL(value string) (*url.URL, error) {
-	upstream, err := url.Parse(value)
-	if err != nil {
-		return nil, fmt.Errorf("%q %w", value, errNotUpstreamURL)
-	}
-
-	onlySchemeAndHost := (upstream.Scheme == "http" || upstream.Scheme == "https") &&
-		upstream.Hostname() != "" && upstream.User == nil &&
-		upstream.Opaque == "" &&
-		(upstream.Path == "" || upstream.Path == "/") &&
-		upstream.RawQuery == "" &&
-		upstream.Fragment == ""
-	if !onlySchemeAndHost {
-		return nil, fmt.Errorf("%q %w", value, errNotUpstreamURL)
-	}
-
-	if upstream.Port() != "" {
-		port, err := strconv.ParseUint(upstream.Port(), 10, 16)
-		if err != nil || port == 0 {
-			return nil, fmt.Errorf("%q %w", value, errNotUpstreamURL)
-		}
-	}
-
-	return upstream, nil
-}

internal/coreruleset/gitea.conf

@@ -105,12 +105,9 @@ SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
 #   932250: ls -la
 #   932260: python3-app
 #   944130: org.apache.commons.logging
-# [^/]+/[^/]+/packages matches an owner's packages page (/alice/-/packages), a
-# repository's (/alice/tools/packages) and gitea's admin page of packages
-# (/-/admin/packages). Forgejo's admin page of packages is /admin/packages.
 SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
-    [^/]+/[^/]+/(?:branches|tags|packages)|admin/packages|\
-    api/v1/repos/search|api/v1/packages/[^/]+)$" \
+    [^/]+/-/packages|[^/]+/[^/]+/(?:branches|tags)|api/v1/repos/search|\
+    api/v1/packages/[^/]+)$" \
     "id:900602,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=930120;ARGS:q,\
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
@@ -123,8 +120,8 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
 # pages, on an owner's packages page and on the admin page of packages also
 # skips this rule:
 #   932160: /bin/sh
-SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
-    admin/packages)$" \
+SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/-/packages|\
+    [^/]+/[^/]+/(?:branches|tags|packages)|(?:-/)?admin/packages)$" \
     "id:900605,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932160;ARGS:q"
 
 # gitea's other searches send a name or a few words in q too, which skips only
@@ -142,26 +139,22 @@ SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
 #     its search for teams;
 #   - the milestones and projects of a repository, a user or an organisation,
 #     and the issues of one milestone;
-#   - the versions of a package;
+#   - a repository's packages, and the versions of a package;
 #   - the issues suggested when an issue is mentioned;
 #   - the runner lists of the site, a user, an organisation and a repository;
 #   - the admin lists of users, organisations, repositories, unadopted
-#     repositories and emails, and the forms on them that adopt a repository or
-#     activate an email, in the body.
+#     repositories, emails and packages, and the forms on them that adopt a
+#     repository or activate an email, in the body.
 # gitea serves its admin pages under /-/admin/ and Forgejo under /admin/.
-# [^/]+/[^/]+/projects matches the projects page of a user or an organisation
-# (/alice/-/projects) as well as a repository's. The path of a package's
-# versions holds the package's name, which can hold a slash, as npm's
-# @scope/name does.
 SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|notifications/watching|\
     explore/(?:users|organizations)|api/v1/users/search|\
     org/[^/]+/(?:(?:issues|pulls|milestones)/[^/]+|teams/-/search)|\
-    [^/]+/-/packages/[^/]+/.+/versions|\
+    [^/]+/-/(?:projects|packages/[^/]+/[^/]+/versions)|\
     [^/]+/[^/]+/(?:(?:issues|pulls)/posters|issues/suggestions|milestones|\
-    milestone/[0-9]+|projects|settings/actions/runners)|\
+    milestone/[0-9]+|projects|packages|settings/actions/runners)|\
     user/settings/actions/runners|\
     (?:-/)?admin/(?:users|orgs|repos|repos/unadopted|emails|emails/activate|\
-    actions/runners))$" \
+    packages|actions/runners))$" \
     "id:900603,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=930120;ARGS:q,\
     ctl:ruleRemoveTargetById=932120;ARGS:q,\

internal/coreruleset/gitea_test.go

@@ -21,7 +21,6 @@ var giteaSearches = []string{
 	"/org/acme/teams/-/search",
 	"/alice/-/projects",
 	"/alice/-/packages/generic/tools-cli/versions",
-	"/alice/-/packages/npm/@alice%2Ftools-cli/versions",
 	"/alice/tools/milestones",
 	"/alice/tools/milestone/1",
 	"/alice/tools/projects",

internal/coreruleset/testdata/forgejo-requests.txt

@@ -685,10 +685,7 @@
 # forms send, sent to Forgejo 17.0.1 with an ordinary Chrome's headers. Each
 # searches for words that name commands and files, such as python3 and
 # .htaccess, and for plain words. A tag or package name can hold a slash, so the
-# tags and packages pages also search for /bin/sh. The packages pages also
-# search for a Maven name. Each search of a package's versions is sent for a
-# generic package and for the npm package @alice/tools-cli, whose name holds a
-# slash.
+# tags and packages pages also search for /bin/sh.
 {"method": "GET", "target": "/explore/topics/search?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/pulls?type=created_by&sort=recentupdate&project=ZgotmplZ&state=open&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/pulls", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/milestones?type=&repos=%5B2%2C1%2C%5D&sort=&state=open&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/milestones", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
@@ -706,7 +703,6 @@
 {"method": "GET", "target": "/alice/-/code?path=&q=python3&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/code", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/projects?state=open&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/projects", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/packages/generic/tools-cli/versions?q=python3&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/generic/tools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=python3&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/npm/@alice%2Ftools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/tags?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/tags", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestones?state=open&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestone/1?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestone/1", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
@@ -745,7 +741,6 @@
 {"method": "GET", "target": "/alice/-/code?path=&q=powershell&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/code", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/projects?state=open&q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/projects", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/packages/generic/tools-cli/versions?q=powershell&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/generic/tools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=powershell&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/npm/@alice%2Ftools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/tags?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/tags", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestones?state=open&q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestone/1?q=powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestone/1", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
@@ -784,7 +779,6 @@
 {"method": "GET", "target": "/alice/-/code?path=&q=ls%20-la&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/code", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/projects?state=open&q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/projects", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/packages/generic/tools-cli/versions?q=ls%20-la&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/generic/tools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=ls%20-la&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/npm/@alice%2Ftools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/tags?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/tags", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestones?state=open&q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestone/1?q=ls%20-la", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestone/1", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
@@ -823,7 +817,6 @@
 {"method": "GET", "target": "/alice/-/code?path=&q=.htaccess&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/code", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/projects?state=open&q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/projects", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/packages/generic/tools-cli/versions?q=.htaccess&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/generic/tools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=.htaccess&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/npm/@alice%2Ftools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/tags?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/tags", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestones?state=open&q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestone/1?q=.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestone/1", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
@@ -863,7 +856,6 @@
 {"method": "GET", "target": "/alice/-/code?path=&q=docker-compose.yml&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/code", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/projects?state=open&q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/projects", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/packages/generic/tools-cli/versions?q=docker-compose.yml&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/generic/tools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=docker-compose.yml&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/npm/@alice%2Ftools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/tags?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/tags", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestones?state=open&q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestone/1?q=docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestone/1", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
@@ -903,7 +895,6 @@
 {"method": "GET", "target": "/alice/-/code?path=&q=install-script.sh&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/code", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/projects?state=open&q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/projects", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/packages/generic/tools-cli/versions?q=install-script.sh&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/generic/tools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=install-script.sh&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/npm/@alice%2Ftools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/tags?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/tags", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestones?state=open&q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestone/1?q=install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestone/1", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
@@ -943,7 +934,6 @@
 {"method": "GET", "target": "/alice/-/code?path=&q=release%20notes&mode=exact", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/code", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/projects?state=open&q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/projects", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/-/packages/generic/tools-cli/versions?q=release%20notes&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/generic/tools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=release%20notes&sort=created_desc", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/-/packages/npm/@alice%2Ftools-cli/versions", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/tags?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/tags", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestones?state=open&q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestones", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/milestone/1?q=release%20notes", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestone/1", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
@@ -968,5 +958,3 @@
 {"method": "GET", "target": "/alice/tools/tags?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/tags", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/packages?q=%2Fbin%2Fsh&type=", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/packages", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/admin/packages?q=%2Fbin%2Fsh&type=", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/packages", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/alice/tools/packages?q=org.apache.commons.logging&type=", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/packages", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/admin/packages?q=org.apache.commons.logging&type=", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/packages", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}

internal/coreruleset/testdata/gitea-requests.txt

@@ -106,9 +106,7 @@
 # forms send, recorded from gitea 1.27.3. Each searches for words that name
 # commands and files, such as python3 and .htaccess, and for plain words. A tag
 # or package name can hold a slash, so the tags and packages pages also search
-# for /bin/sh. The packages pages also search for a Maven name. Each search of a
-# package's versions is sent for a generic package and for the npm package
-# @alice/tools-cli, whose name holds a slash.
+# for /bin/sh.
 /explore/topics/search?q=python3
 /pulls?type=your_repositories&sort=recentupdate&state=open&q=python3&search_mode=exact
 /milestones?type=&repos=%5B2%2C1%2C%5D&sort=&state=open&q=python3
@@ -126,7 +124,6 @@
 /alice/-/code?q=python3&search_mode=exact
 /alice/-/projects?state=open&q=python3
 /alice/-/packages/generic/tools-cli/versions?q=python3&sort=created_desc
-/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=python3&sort=created_desc
 /alice/tools/tags?q=python3
 /alice/tools/milestones?state=open&q=python3
 /alice/tools/milestone/1?q=python3
@@ -163,7 +160,6 @@
 /alice/-/code?q=powershell&search_mode=exact
 /alice/-/projects?state=open&q=powershell
 /alice/-/packages/generic/tools-cli/versions?q=powershell&sort=created_desc
-/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=powershell&sort=created_desc
 /alice/tools/tags?q=powershell
 /alice/tools/milestones?state=open&q=powershell
 /alice/tools/milestone/1?q=powershell
@@ -200,7 +196,6 @@
 /alice/-/code?q=ls%20-la&search_mode=exact
 /alice/-/projects?state=open&q=ls%20-la
 /alice/-/packages/generic/tools-cli/versions?q=ls%20-la&sort=created_desc
-/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=ls%20-la&sort=created_desc
 /alice/tools/tags?q=ls%20-la
 /alice/tools/milestones?state=open&q=ls%20-la
 /alice/tools/milestone/1?q=ls%20-la
@@ -237,7 +232,6 @@
 /alice/-/code?q=.htaccess&search_mode=exact
 /alice/-/projects?state=open&q=.htaccess
 /alice/-/packages/generic/tools-cli/versions?q=.htaccess&sort=created_desc
-/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=.htaccess&sort=created_desc
 /alice/tools/tags?q=.htaccess
 /alice/tools/milestones?state=open&q=.htaccess
 /alice/tools/milestone/1?q=.htaccess
@@ -275,7 +269,6 @@
 /alice/-/code?q=docker-compose.yml&search_mode=exact
 /alice/-/projects?state=open&q=docker-compose.yml
 /alice/-/packages/generic/tools-cli/versions?q=docker-compose.yml&sort=created_desc
-/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=docker-compose.yml&sort=created_desc
 /alice/tools/tags?q=docker-compose.yml
 /alice/tools/milestones?state=open&q=docker-compose.yml
 /alice/tools/milestone/1?q=docker-compose.yml
@@ -313,7 +306,6 @@
 /alice/-/code?q=install-script.sh&search_mode=exact
 /alice/-/projects?state=open&q=install-script.sh
 /alice/-/packages/generic/tools-cli/versions?q=install-script.sh&sort=created_desc
-/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=install-script.sh&sort=created_desc
 /alice/tools/tags?q=install-script.sh
 /alice/tools/milestones?state=open&q=install-script.sh
 /alice/tools/milestone/1?q=install-script.sh
@@ -351,7 +343,6 @@
 /alice/-/code?q=release%20notes&search_mode=exact
 /alice/-/projects?state=open&q=release%20notes
 /alice/-/packages/generic/tools-cli/versions?q=release%20notes&sort=created_desc
-/alice/-/packages/npm/@alice%2Ftools-cli/versions?q=release%20notes&sort=created_desc
 /alice/tools/tags?q=release%20notes
 /alice/tools/milestones?state=open&q=release%20notes
 /alice/tools/milestone/1?q=release%20notes
@@ -374,8 +365,6 @@
 /alice/tools/tags?q=%2Fbin%2Fsh
 /alice/tools/packages?q=%2Fbin%2Fsh&type=
 /-/admin/packages?q=%2Fbin%2Fsh&type=
-/alice/tools/packages?q=org.apache.commons.logging&type=
-/-/admin/packages?q=org.apache.commons.logging&type=
 
 # Pages, raw files and edit pages of files, and the API's call for their
 # contents.