Core Rule Set: Forgejo's searches at a branch or tag, of releases and of job logs pass (closes #350)

`testdata/forgejo-requests.txt` records these Forgejo 17.0.1 searches with the hard values, file names and plain words, and the code search with code and a page opened from each search. `forgejo.conf` lets them through:

- the code search at a branch or tag, where the home page's search box sends its search without a code indexer: `q` skips what it skips on gitea's code search, and `Referer` what it skips after gitea's searches;
- the release search, page and API: `q` skips 930120, 932120, 932160, 932250 and 932260, since it matches tag names;
- the job log search in the API: the same, without 932160.

In `gitea.conf`, `q` on the branch and package searches also skips 932160, so `/bin/sh` passes there. `SPEC.md` lists both.

Model: opus-5-5

SPEC.md

@@ -829,30 +829,17 @@ The changes hold in front of every app, and no setting undoes them:
         - branches and tags;
         - packages, on its pages and in its API.
 
-        A user's or an organisation's page has a path of one segment, such as
+        A user's or an organisation's page is any path of one segment, so on
-        `/alice`. So on any app, `q` skips these rules on every path of one
+        every such path, on any app, `q` skips 930120, 932120 and 932260, for
-        segment, such as `/search`. But it skips 932250 only on a path made of
+        example on `/search`. It keeps 932250 there, so `ls -la` is refused on
-        the characters a name may hold: letters, digits, `-`, `_` and dots, the
+        those pages.
-        first a letter or digit. So `ls -la` is refused on
-        `/login.jsp;jsessionid=abc`. `q` also keeps 932250 on a path that ends
-        in a server-side script's extension, such as `/index.php`. The
-        extensions are these, in upper or lower case:
-        - `.php`;
-        - `.phtml`;
-        - `.php5`;
-        - `.cgi`;
-        - `.pl`;
-        - `.py`;
-        - `.asp`;
-        - `.aspx`;
-        - `.jsp`.
 
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.
 
         A branch or package name can hold a slash, as `feat/docker-support`
-        does. So `q` on a repository's branches page and on an owner's packages
+        does. So the searches of a repository's branches and of an owner's
-        page also skips the rule for shell paths (932160), which refused
+        packages also skip the rule for shell paths (932160), which refused
         `/bin/sh`.
 
     - The path of these requests, which names a file:

internal/coreruleset/coreruleset_test.go

@@ -1063,50 +1063,6 @@ func TestGiteaAttacksAreRefused(t *testing.T) {
 	}
 }
 
-func TestGiteaSearchOnAUsersOrAnOrganisationsPageLetsLsThrough(t *testing.T) {
-	t.Parallel()
-
-	crs := atDefaults(t)
-
-	// The searches of a user's and of an organisation's repositories.
-	for _, target := range []string{
-		"/alice?tab=repositories&q=ls%20-la",
-		"/acme?q=ls%20-la&sort=recentupdate",
-		"/jane.doe?tab=repositories&q=ls%20-la",
-	} {
-		wantResult(t, crs, get(target), coreruleset.Result{})
-	}
-
-	// 932250 still applies on a path that ends in a server-side script's
-	// extension or holds a character no name holds, to another field, and on
-	// a path of two segments.
-	for _, target := range []string{
-		"/index.php?q=ls%20-la",
-		"/INDEX.PHP?q=ls%20-la",
-		"/index%2Ephp?q=ls%20-la",
-		"/search.cgi?q=ls%20-la",
-		"/login.jsp;jsessionid=abc?q=ls%20-la",
-		"/alice?tab=ls%20-la",
-		"/alice/tools?q=ls%20-la",
-	} {
-		wantResult(t, crs, get(target), matched(932250))
-	}
-
-	// A command after a ";" in q is still refused on each of these paths.
-	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
-
-	for _, target := range []string{
-		"/alice?tab=repositories&q=",
-		"/index.php?q=",
-		"/wp-login.php?q=",
-		"/alice/tools?q=",
-	} {
-		if got := inspect(t, crs, get(target+commandInjection)); got.Score < threshold {
-			t.Errorf("%s%s let through: %+v", target, commandInjection, got)
-		}
-	}
-}
-
 // WordPress's paths: signing in, posting a comment, admin-ajax.php, and the
 // REST API routes of a post and of the tags.
 const (

internal/coreruleset/gitea.conf

@@ -116,8 +116,8 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
     ctl:ruleRemoveTargetById=944130;ARGS:q"
 
 # A branch or package name can hold a slash, as feat/docker-support and npm's
-# @scope/name do. So q on a repository's branches page and on an owner's
+# @scope/name do. So q on the searches of a repository's branches and of an
-# packages page also skips this rule:
+# owner's packages also skips this rule there:
 #   932160: /bin/sh
 SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/-/packages|[^/]+/[^/]+/branches)$" \
     "id:900605,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932160;ARGS:q"
@@ -142,8 +142,8 @@ SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
 # The repositories on a user's or an organisation's page are searched with q
-# too. Their path has one segment, so q skips these rules on every path of one
+# too. Their path has one segment, as other apps' pages such as /index.php do,
-# segment, other apps' pages such as /index.php included:
+# so q keeps 932250 there and skips only these rules:
 #   930120: .profile
 #   932120: powershell-scripts
 #   932260: python3-app
@@ -153,16 +153,6 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+$" \
     ctl:ruleRemoveTargetById=932120;ARGS:q,\
     ctl:ruleRemoveTargetById=932260;ARGS:q"
 
-# On those pages q skips 932250 too, which refused ls -la, but only on a path
-# made of the characters a user's or an organisation's name may hold. Those are
-# letters, digits, -, _ and dots, the first a letter or digit, so
-# /login.jsp;jsessionid=abc keeps 932250. A path that ends in a server-side
-# script's extension keeps it too, such as /index.php or /search.cgi.
-SecRule REQUEST_FILENAME "@rx ^/[0-9A-Za-z][-.\w]*$" \
-    "id:900606,phase:1,pass,nolog,chain"
-    SecRule REQUEST_FILENAME "!@rx \.(?:php|phtml|php5|cgi|pl|py|asp|aspx|jsp)$" \
-        "t:lowercase,ctl:ruleRemoveTargetById=932250;ARGS:q"
-
 # These requests name a file in the path, which skips these rules there:
 #   920500: notes.txt~
 #   934100: process.env.d.ts

internal/coreruleset/testdata/forgejo-requests.txt

@@ -677,7 +677,3 @@
 {"method": "GET", "target": "/repo-avatars/f9e66d43eb4888aac5d9d93745661631a09b4c73969226a3e89b2911ece215ba", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice", "Accept-Encoding: gzip, deflate", "Cookie: session=00a162ad65e95a87; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/avatars/53bce4f1dfa0fe8e7ca126f91b35d3a6?size=64", "headers": ["Host: example.com", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://example.com/alice", "Accept-Encoding: gzip, deflate", "Cookie: session=00a162ad65e95a87; lang=en-US"], "body": ""}
 {"method": "GET", "target": "/acme?q=python3&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=00a162ad65e95a87; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/alice?q=ls+-la&tab=repositories&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice?tab=repositories", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/acme?q=ls+-la&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/acme?q=powershell&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}
-{"method": "GET", "target": "/acme?q=.htaccess&sort=recentupdate", "headers": ["Host: example.com", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/acme", "Accept-Encoding: gzip, deflate", "Cookie: session=4f05e01703d2563d; lang=en-US"], "body": ""}

internal/coreruleset/testdata/gitea-requests.txt

@@ -91,17 +91,6 @@
 /explore/organizations?q=docker-ci
 /api/v1/users/search?q=docker-ci
 
-# Searches of the repositories on a user's and an organisation's page, recorded
-# from gitea 1.27.3.
-/alice?tab=repositories&q=ls+-la&sort=recentupdate
-/alice?tab=repositories&q=python3&sort=recentupdate
-/alice?tab=repositories&q=powershell&sort=recentupdate
-/alice?tab=repositories&q=.htaccess&sort=recentupdate
-/acme?q=ls+-la&sort=recentupdate
-/acme?q=python3&sort=recentupdate
-/acme?q=powershell&sort=recentupdate
-/acme?q=.htaccess&sort=recentupdate
-
 # Pages, raw files and edit pages of files, and the API's call for their
 # contents.
 /owner/repo/src/branch/main/package.json