Core Rule Set: ls -la passes in q on a gitea user's or organisation's page (closes #349)

On a path of one segment, q now skips 932250 too, unless the path ends
in a server-side script's extension, such as .php or .cgi. The searches
on a user's and an organisation's page are recorded from gitea 1.27.3
and Forgejo 17.0.1.

Model: opus-5-5

SPEC.md

@@ -830,12 +830,9 @@ The changes hold in front of every app, and no setting undoes them:
 
         A user's or an organisation's page has a path of one segment, such as
         `/alice`. So on any app, `q` skips these rules on every path of one
-        segment, such as `/search`. But it skips 932250 only on a path made of
+        segment, such as `/search`. Such a path keeps 932250 when it ends in a
-        the characters a name may hold: letters, digits, `-`, `_` and dots, the
+        server-side script's extension, such as `/index.php`, so `ls -la` is
-        first a letter or digit. So `ls -la` is refused on
+        refused there. The extensions are these, in upper or lower case:
-        `/login.jsp;jsessionid=abc`. `q` also keeps 932250 on a path that ends
-        in a server-side script's extension, such as `/index.php`. The
-        extensions are these, in upper or lower case:
         - `.php`;
         - `.phtml`;
         - `.php5`;

internal/coreruleset/coreruleset_test.go

@@ -1078,14 +1078,12 @@ func TestGiteaSearchOnAUsersOrAnOrganisationsPageLetsLsThrough(t *testing.T) {
 	}
 
 	// 932250 still applies on a path that ends in a server-side script's
-	// extension or holds a character no name holds, to another field, and on
+	// extension, to another field, and on a path of two segments.
-	// a path of two segments.
 	for _, target := range []string{
 		"/index.php?q=ls%20-la",
 		"/INDEX.PHP?q=ls%20-la",
 		"/index%2Ephp?q=ls%20-la",
 		"/search.cgi?q=ls%20-la",
-		"/login.jsp;jsessionid=abc?q=ls%20-la",
 		"/alice?tab=ls%20-la",
 		"/alice/tools?q=ls%20-la",
 	} {

internal/coreruleset/gitea.conf

@@ -146,12 +146,9 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
-# On those pages q skips 932250 too, which refused ls -la, but only on a path
+# On those pages q skips 932250 too, which refused ls -la. A path keeps it when
-# made of the characters a user's or an organisation's name may hold. Those are
+# it ends in a server-side script's extension, such as /index.php or /search.cgi.
-# letters, digits, -, _ and dots, the first a letter or digit, so
+SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
-# /login.jsp;jsessionid=abc keeps 932250. A path that ends in a server-side
-# script's extension keeps it too, such as /index.php or /search.cgi.
-SecRule REQUEST_FILENAME "@rx ^/[0-9A-Za-z][-.\w]*$" \
     "id:900606,phase:1,pass,nolog,chain"
     SecRule REQUEST_FILENAME "!@rx \.(?:php|phtml|php5|cgi|pl|py|asp|aspx|jsp)$" \
         "t:lowercase,ctl:ruleRemoveTargetById=932250;ARGS:q"