Core Rule Set: gitea's search Referer exclusion skips /api/v2/search (closes #270)

Rule 900601 let Referer skip five rules when it named a repository's
search, issues or pull requests with the owner api, such as
/api/v2/search, Mastodon's search. A page opened from there skipped
script and SQL injection checks on Referer. gitea has no owner named
api, so a chained condition now leaves out those paths, as rule 900600
does.

Model: opus-5-5

internal/coreruleset/coreruleset_test.go

@@ -692,6 +692,14 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 				t.Errorf("%s let through: %+v", target, got)
 			}
 		}
+
+		// Nor is a page opened from them.
+		for _, attack := range []string{scriptTag, injection} {
+			referer := "Referer: https://example.com" + path + "?q=" + attack
+			if got := inspect(t, crs, get("/", referer)); got.Score < threshold {
+				t.Errorf("%s let through: %+v", referer, got)
+			}
+		}
 	}
 }
 

internal/coreruleset/gitea.conf

@@ -83,17 +83,20 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
 #   941160: <img src=
 #   942100: LIKE '%foo%'
 #   944100: java.lang.Runtime
+# A repository with the owner api is left out here too.
 SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
     issues(?:/search)?|pulls|[^/]+/-/code|\
     [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
     commits/(?:branch|tag|commit)/.+/search)|\
     api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))\?" \
-    "id:900601,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
+    "id:900601,phase:1,pass,nolog,chain"
+    SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/[^/]+/(?:search|\
+        issues(?:/search)?|pulls|commits/(?:branch|tag|commit)/.+/search)\?" \
+        "ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
 
 # gitea's searches of repositories, users, branches, tags and packages send a
 # name in q, which skips these rules there: