Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352)

Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips
930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and
Forgejo's /admin/ alike, and in the body of the admin forms that adopt a
repository or activate an email. The issue and pull request searches of a
team and of a milestone join 900600 and 900601, as a repository's do. A
repository's packages page and the admin packages page join 900602, which
also skips 944130. 900605, which lets /bin/sh through in q on branches and
owner packages, now also covers the tags page and those two pages, since tag
and package names can hold a slash.

Model: opus-5-5

SPEC.md

@@ -817,7 +817,10 @@ The changes hold in front of every app, and no setting undoes them:
    request it refused. The fields are:
     - `q` on gitea's searches of code, of issues and pull requests, and of
       commits. A code search holds code, such as `<script>`,
-      `SELECT * FROM users WHERE` or `../`.
+      `SELECT * FROM users WHERE` or `../`. The searches of issues and pull
+      requests include these:
+        - an organisation's issues and pull requests of one team;
+        - the issues and pull requests of one milestone.
     - `Referer` of a page opened from such a search, for script and SQL
       injection and Java code (941110, 941120, 941160, 942100, 944100).
     - `q` on gitea's searches for a name, for the lists of system files and
@@ -864,11 +867,10 @@ The changes hold in front of every app, and no setting undoes them:
       `python3`, `powershell`, `ls -la` and `.htaccess` were refused there. The
       searches are:
         - the list of repositories a user watches;
-        - an organisation's issues, pull requests and milestones of one team;
+        - an organisation's milestones of one team;
         - an organisation's search for teams;
-        - the milestones and projects of a repository, a user or an
-          organisation;
-        - the issues of one milestone;
+        - the milestones of a repository or an organisation;
+        - the projects of a repository, a user or an organisation;
         - the versions of a package;
         - the issues suggested when an issue is mentioned;
         - the runner lists of the site, a user, an organisation and a

internal/coreruleset/coreruleset_test.go

@@ -1036,11 +1036,13 @@ func TestGiteaAttacksAreRefused(t *testing.T) {
 	}
 
 	// gitea has no owner named api, so these are not a repository's search,
-	// issues or pull requests. /api/v2/search is Mastodon's search.
+	// issues, pull requests or milestone page. /api/v2/search is Mastodon's
+	// search.
 	for _, path := range []string{
 		"/api/v2/search",
 		"/api/v2/issues",
 		"/api/v2/pulls",
+		"/api/v2/milestone/1",
 	} {
 		for _, attack := range []string{
 			sqlInjection,

internal/coreruleset/gitea.conf

@@ -35,17 +35,20 @@
 #   944100: java.lang.Runtime
 #   944110: java.lang.Runtime
 #   944130: java.lang.Runtime
-# gitea has no owner named api. A repository's search, issues, pull requests and
-# commit search with that owner get none of this. /api/v2/search, for example,
-# is Mastodon's search.
+# The searches of issues and pull requests include those of one team of an
+# organisation, such as /org/acme/issues/developers, and of one milestone, such
+# as /alice/tools/milestone/1.
+# gitea has no owner named api. A repository's search, issues, pull requests,
+# milestone pages and commit search with that owner get none of this.
+# /api/v2/search, for example, is Mastodon's search.
 SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
-    [^/]+/-/code|\
-    [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
+    [^/]+/-/code|org/[^/]+/(?:issues|pulls)/[^/]+|\
+    [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|milestone/[0-9]+|\
     commits/(?:branch|tag|commit)/.+/search)|\
     api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))$" \
     "id:900600,phase:1,pass,nolog,chain"
     SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/(?:search|issues(?:/search)?|\
-        pulls|commits/(?:branch|tag|commit)/.+/search)$" \
+        pulls|milestone/[0-9]+|commits/(?:branch|tag|commit)/.+/search)$" \
         "ctl:ruleRemoveTargetById=930110;ARGS:q,\
         ctl:ruleRemoveTargetById=930120;ARGS:q,\
         ctl:ruleRemoveTargetById=931100;ARGS:q,\
@@ -85,13 +88,14 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
 #   944100: java.lang.Runtime
 # A repository with the owner api is left out here too.
 SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
-    issues(?:/search)?|pulls|[^/]+/-/code|\
-    [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
+    issues(?:/search)?|pulls|[^/]+/-/code|org/[^/]+/(?:issues|pulls)/[^/]+|\
+    [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|milestone/[0-9]+|\
     commits/(?:branch|tag|commit)/.+/search)|\
     api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))\?" \
     "id:900601,phase:1,pass,nolog,chain"
     SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/[^/]+/(?:search|\
-        issues(?:/search)?|pulls|commits/(?:branch|tag|commit)/.+/search)\?" \
+        issues(?:/search)?|pulls|milestone/[0-9]+|\
+        commits/(?:branch|tag|commit)/.+/search)\?" \
         "ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
         ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
         ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
@@ -138,10 +142,9 @@ SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
 #   - the author filter of the issue and pull request lists;
 #   - the lists of users and organisations, and the API's search for users;
 #   - the list of repositories a user watches;
-#   - an organisation's issues, pull requests and milestones of one team, and
-#     its search for teams;
-#   - the milestones and projects of a repository, a user or an organisation,
-#     and the issues of one milestone;
+#   - an organisation's milestones of one team, and its search for teams;
+#   - the milestones of a repository or an organisation, and the projects of a
+#     repository, a user or an organisation;
 #   - the versions of a package;
 #   - the issues suggested when an issue is mentioned;
 #   - the runner lists of the site, a user, an organisation and a repository;
@@ -155,10 +158,10 @@ SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
 # @scope/name does.
 SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|notifications/watching|\
     explore/(?:users|organizations)|api/v1/users/search|\
-    org/[^/]+/(?:(?:issues|pulls|milestones)/[^/]+|teams/-/search)|\
+    org/[^/]+/(?:milestones/[^/]+|teams/-/search)|\
     [^/]+/-/packages/[^/]+/.+/versions|\
     [^/]+/[^/]+/(?:(?:issues|pulls)/posters|issues/suggestions|milestones|\
-    milestone/[0-9]+|projects|settings/actions/runners)|\
+    projects|settings/actions/runners)|\
     user/settings/actions/runners|\
     (?:-/)?admin/(?:users|orgs|repos|repos/unadopted|emails|emails/activate|\
     actions/runners))$" \

internal/coreruleset/gitea_test.go

@@ -15,15 +15,12 @@ import (
 //nolint:gochecknoglobals // a constant cannot be a list
 var giteaSearches = []string{
 	"/notifications/watching",
-	"/org/acme/issues/developers",
-	"/org/acme/pulls/developers",
 	"/org/acme/milestones/developers",
 	"/org/acme/teams/-/search",
 	"/alice/-/projects",
 	"/alice/-/packages/generic/tools-cli/versions",
 	"/alice/-/packages/npm/@alice%2Ftools-cli/versions",
 	"/alice/tools/milestones",
-	"/alice/tools/milestone/1",
 	"/alice/tools/projects",
 	"/alice/tools/issues/suggestions",
 	"/alice/tools/settings/actions/runners",
@@ -118,9 +115,7 @@ func TestGiteaSearchExclusionsAreNarrow(t *testing.T) {
 	}
 
 	// /bin/sh and the hard values stay refused in q on paths near the
-	// searches, and in another field on them. Paths under /admin/ are left
-	// out here: the tenth change lets the hard values through in q on all of
-	// them, for Drupal.
+	// searches, and in another field on them.
 	for _, target := range []string{
 		"/org/acme/teams?q=",
 		"/org/acme/teams/-/search/x?q=",
@@ -151,4 +146,16 @@ func TestGiteaSearchExclusionsAreNarrow(t *testing.T) {
 			}
 		}
 	}
+
+	// Under /admin/, where Forgejo serves its admin pages, only /bin/sh is
+	// checked: the tenth change lets the hard values through in q on every
+	// path there, for Drupal.
+	for _, target := range []string{
+		"/admin/packages/delete?q=",
+		"/admin/packages?other=",
+	} {
+		if got := inspect(t, crs, get(target+"%2Fbin%2Fsh")); got.Score < threshold {
+			t.Errorf("%s%%2Fbin%%2Fsh let through: %+v", target, got)
+		}
+	}
 }

internal/coreruleset/testdata/forgejo-requests.txt

@@ -686,9 +686,10 @@
 # searches for words that name commands and files, such as python3 and
 # .htaccess, and for plain words. A tag or package name can hold a slash, so the
 # tags and packages pages also search for /bin/sh. The packages pages also
-# search for a Maven name. Each search of a package's versions is sent for a
-# generic package and for the npm package @alice/tools-cli, whose name holds a
-# slash.
+# search for a Maven name. The issues and pull requests of one team, and those
+# of one milestone, are also searched for SQL. Each search of a package's
+# versions is sent for a generic package and for the npm package
+# @alice/tools-cli, whose name holds a slash.
 {"method": "GET", "target": "/explore/topics/search?q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://example.com/alice/tools", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/pulls?type=created_by&sort=recentupdate&project=ZgotmplZ&state=open&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/pulls", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/milestones?type=&repos=%5B2%2C1%2C%5D&sort=&state=open&q=python3", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/milestones", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
@@ -970,3 +971,6 @@
 {"method": "GET", "target": "/admin/packages?q=%2Fbin%2Fsh&type=", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/packages", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/alice/tools/packages?q=org.apache.commons.logging&type=", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/packages", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/admin/packages?q=org.apache.commons.logging&type=", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/admin/packages", "Accept-Encoding: gzip, deflate", "Cookie: session=e75e81138febd1bb; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/org/acme/issues/developers?type=your_repositories&sort=recentupdate&project=ZgotmplZ&state=open&q=SELECT%20%2A%20FROM%20users%20WHERE", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/org/acme/issues/developers", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/org/acme/pulls/developers?type=your_repositories&sort=recentupdate&project=ZgotmplZ&state=open&q=SELECT%20%2A%20FROM%20users%20WHERE", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/org/acme/pulls/developers", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}
+{"method": "GET", "target": "/alice/tools/milestone/1?q=SELECT%20%2A%20FROM%20users%20WHERE", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/milestone/1", "Accept-Encoding: gzip, deflate", "Cookie: session=5d2e8a17c4b9f063; lang=en-US"], "body": ""}

internal/coreruleset/testdata/gitea-requests.txt

@@ -106,9 +106,10 @@
 # forms send, recorded from gitea 1.27.3. Each searches for words that name
 # commands and files, such as python3 and .htaccess, and for plain words. A tag
 # or package name can hold a slash, so the tags and packages pages also search
-# for /bin/sh. The packages pages also search for a Maven name. Each search of a
-# package's versions is sent for a generic package and for the npm package
-# @alice/tools-cli, whose name holds a slash.
+# for /bin/sh. The packages pages also search for a Maven name. The issues and
+# pull requests of one team, and those of one milestone, are also searched for
+# SQL. Each search of a package's versions is sent for a generic package and for
+# the npm package @alice/tools-cli, whose name holds a slash.
 /explore/topics/search?q=python3
 /pulls?type=your_repositories&sort=recentupdate&state=open&q=python3&search_mode=exact
 /milestones?type=&repos=%5B2%2C1%2C%5D&sort=&state=open&q=python3
@@ -376,6 +377,9 @@
 /-/admin/packages?q=%2Fbin%2Fsh&type=
 /alice/tools/packages?q=org.apache.commons.logging&type=
 /-/admin/packages?q=org.apache.commons.logging&type=
+/org/acme/issues/developers?type=your_repositories&sort=recentupdate&state=open&q=SELECT%20%2A%20FROM%20users%20WHERE&search_mode=exact
+/org/acme/pulls/developers?type=your_repositories&sort=recentupdate&state=open&q=SELECT%20%2A%20FROM%20users%20WHERE&search_mode=exact
+/alice/tools/milestone/1?q=SELECT%20%2A%20FROM%20users%20WHERE
 
 # Pages, raw files and edit pages of files, and the API's call for their
 # contents.