Part of #212. Found in the review of #347, which records Forgejo 17.0.1.
Forgejo 17.0.1 reads a search from each query field below, q unless another is named. internal/coreruleset/testdata/forgejo-requests.txt does not hold them with the hard values: python3, powershell, ls -la, .htaccess, file names and plain words. Some are in it with a few values only. gitea 1.27.3 serves the same pages, except those marked "Forgejo only".
Record each with the hard values. Where one is refused, let it through as the recorded searches are: in internal/coreruleset/gitea.conf, or in forgejo.conf for the Forgejo-only ones.
Pages:
/explore/topics/search;
/pulls, /milestones, /issues/search, /repo/search, /user/search_candidates and /notifications/watching;
/org/ORG/issues, /org/ORG/pulls and /org/ORG/milestones, each also with /TEAM after it, and /org/ORG/teams/-/search;
an organisation's page, /ORG, except ls -la, which #349 tracks;
/OWNER/-/code, /OWNER/-/projects and /OWNER/-/packages/TYPE/NAME/versions;
under /OWNER/REPO/: tags, milestones, milestone/ID, projects, packages, issues/posters, pulls/posters, issues/search and issues/suggestions;
under /OWNER/REPO/, Forgejo only: releases, and the code search at a branch or tag, search/branch/BRANCH and search/tag/TAG;
the runner lists: /admin/actions/runners, /user/settings/actions/runners, /org/ORG/settings/actions/runners and /OWNER/REPO/settings/actions/runners;
/admin/users, /admin/orgs, /admin/repos, /admin/repos/unadopted, /admin/emails and /admin/packages, and q in the body of POST /admin/repos/unadopted and POST /admin/emails/activate.
Today drupal.conf has q skip 930120, 932120, 932250 and 932260 on every /admin/ path, whatever the app. SWW_APPS (#225) groups each app's fixes by hostname, so gitea's admin pages need their own.
At the default settings Forgejo has no code indexer. Without one, the search box on a repository's home page sends its search to /OWNER/REPO/search/branch/BRANCH. No exclusion in gitea.conf or forgejo.conf covers that path.
API, under /api/v1/:
repos/search, users/search, repos/issues/search, packages/OWNER, topics/search, orgs/ORG/teams/search and admin/emails/search;
admin/unadopted, in query;
under repos/OWNER/REPO/: issues, and milestones in name;
under repos/OWNER/REPO/, Forgejo only: releases and actions/jobs/ID/logs.
Package registries, under /api/packages/OWNER/:
Cargo: cargo/api/v1/crates;
Chef: chef/api/v1/search and chef/api/v1/cookbooks;
Composer: composer/search.json;
Conan: conan/v1/conans/search and conan/v2/conans/search;
NuGet: nuget/query, and nuget/Search() and nuget/Packages() in searchTerm and $filter;
npm: npm/-/v1/search, in text.
/notifications/subscriptions reads no search. The notification pages' search box is on /notifications/watching.
Model: opus-5-5
Part of https://git.eeqj.de/sneak/smallwebwaf/issues/212. Found in the review of https://git.eeqj.de/sneak/smallwebwaf/pulls/347, which records Forgejo 17.0.1.
Forgejo 17.0.1 reads a search from each query field below, `q` unless another is named. `internal/coreruleset/testdata/forgejo-requests.txt` does not hold them with the hard values: `python3`, `powershell`, `ls -la`, `.htaccess`, file names and plain words. Some are in it with a few values only. gitea 1.27.3 serves the same pages, except those marked "Forgejo only".
Record each with the hard values. Where one is refused, let it through as the recorded searches are: in `internal/coreruleset/gitea.conf`, or in `forgejo.conf` for the Forgejo-only ones.
Pages:
- `/explore/topics/search`;
- `/pulls`, `/milestones`, `/issues/search`, `/repo/search`, `/user/search_candidates` and `/notifications/watching`;
- `/org/ORG/issues`, `/org/ORG/pulls` and `/org/ORG/milestones`, each also with `/TEAM` after it, and `/org/ORG/teams/-/search`;
- an organisation's page, `/ORG`, except `ls -la`, which https://git.eeqj.de/sneak/smallwebwaf/issues/349 tracks;
- `/OWNER/-/code`, `/OWNER/-/projects` and `/OWNER/-/packages/TYPE/NAME/versions`;
- under `/OWNER/REPO/`: `tags`, `milestones`, `milestone/ID`, `projects`, `packages`, `issues/posters`, `pulls/posters`, `issues/search` and `issues/suggestions`;
- under `/OWNER/REPO/`, Forgejo only: `releases`, and the code search at a branch or tag, `search/branch/BRANCH` and `search/tag/TAG`;
- the runner lists: `/admin/actions/runners`, `/user/settings/actions/runners`, `/org/ORG/settings/actions/runners` and `/OWNER/REPO/settings/actions/runners`;
- `/admin/users`, `/admin/orgs`, `/admin/repos`, `/admin/repos/unadopted`, `/admin/emails` and `/admin/packages`, and `q` in the body of `POST /admin/repos/unadopted` and `POST /admin/emails/activate`.
Today `drupal.conf` has `q` skip 930120, 932120, 932250 and 932260 on every `/admin/` path, whatever the app. `SWW_APPS` (https://git.eeqj.de/sneak/smallwebwaf/pulls/225) groups each app's fixes by hostname, so gitea's admin pages need their own.
At the default settings Forgejo has no code indexer. Without one, the search box on a repository's home page sends its search to `/OWNER/REPO/search/branch/BRANCH`. No exclusion in `gitea.conf` or `forgejo.conf` covers that path.
API, under `/api/v1/`:
- `repos/search`, `users/search`, `repos/issues/search`, `packages/OWNER`, `topics/search`, `orgs/ORG/teams/search` and `admin/emails/search`;
- `admin/unadopted`, in `query`;
- under `repos/OWNER/REPO/`: `issues`, and `milestones` in `name`;
- under `repos/OWNER/REPO/`, Forgejo only: `releases` and `actions/jobs/ID/logs`.
Package registries, under `/api/packages/OWNER/`:
- Cargo: `cargo/api/v1/crates`;
- Chef: `chef/api/v1/search` and `chef/api/v1/cookbooks`;
- Composer: `composer/search.json`;
- Conan: `conan/v1/conans/search` and `conan/v2/conans/search`;
- NuGet: `nuget/query`, and `nuget/Search()` and `nuget/Packages()` in `searchTerm` and `$filter`;
- npm: `npm/-/v1/search`, in `text`.
`/notifications/subscriptions` reads no search. The notification pages' search box is on `/notifications/watching`.
Model: opus-5-5
Scope. This issue is now the Forgejo-only routes, recorded with the hard values and let through in internal/coreruleset/forgejo.conf:
the code search at a branch or tag, /OWNER/REPO/search/branch/BRANCH and /OWNER/REPO/search/tag/TAG, including the request the home page's search box sends with no code indexer (the default), and /bin/sh recorded there, since branch and tag names can hold a slash;
the release search, /OWNER/REPO/releases and /api/v1/repos/OWNER/REPO/releases;
the job log search, /api/v1/repos/OWNER/REPO/actions/jobs/ID/logs.
The code search at a branch or tag lets q through as the eighth change does on /OWNER/REPO/search; the release and log searches skip only the rules the recorded values set off. Add the routes to forgejoSearches and nearby paths to TestForgejoExclusionsAreNarrow, and list them in the fifteenth change in SPEC.md.
The rest moved: the shared pages to #352, the API searches to #353, the package registries to #354.
One PR into next, after #347 lands. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending (closes #350). Label the PR needs-review.
Model: opus-5-5
**Scope.** This issue is now the Forgejo-only routes, recorded with the hard values and let through in `internal/coreruleset/forgejo.conf`:
- the code search at a branch or tag, `/OWNER/REPO/search/branch/BRANCH` and `/OWNER/REPO/search/tag/TAG`, including the request the home page's search box sends with no code indexer (the default), and `/bin/sh` recorded there, since branch and tag names can hold a slash;
- the release search, `/OWNER/REPO/releases` and `/api/v1/repos/OWNER/REPO/releases`;
- the job log search, `/api/v1/repos/OWNER/REPO/actions/jobs/ID/logs`.
The code search at a branch or tag lets `q` through as the eighth change does on `/OWNER/REPO/search`; the release and log searches skip only the rules the recorded values set off. Add the routes to `forgejoSearches` and nearby paths to `TestForgejoExclusionsAreNarrow`, and list them in the fifteenth change in `SPEC.md`.
The rest moved: the shared pages to https://git.eeqj.de/sneak/smallwebwaf/issues/352, the API searches to https://git.eeqj.de/sneak/smallwebwaf/issues/353, the package registries to https://git.eeqj.de/sneak/smallwebwaf/issues/354.
One PR into `next`, after https://git.eeqj.de/sneak/smallwebwaf/pulls/347 lands. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending ` (closes #350)`. Label the PR `needs-review`.
Model: opus-5-5
Also record /bin/sh on each search above for a branch, tag or package name, since those names can hold a slash (feat/docker-support, npm's @scope/name). Record it too on /OWNER/REPO/branches and /OWNER/-/packages, which #347 records without it.
Model: opus-5-5
Also record `/bin/sh` on each search above for a branch, tag or package name, since those names can hold a slash (`feat/docker-support`, npm's `@scope/name`). Record it too on `/OWNER/REPO/branches` and `/OWNER/-/packages`, which https://git.eeqj.de/sneak/smallwebwaf/pulls/347 records without it.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #212. Found in the review of #347, which records Forgejo 17.0.1.
Forgejo 17.0.1 reads a search from each query field below,
qunless another is named.internal/coreruleset/testdata/forgejo-requests.txtdoes not hold them with the hard values:python3,powershell,ls -la,.htaccess, file names and plain words. Some are in it with a few values only. gitea 1.27.3 serves the same pages, except those marked "Forgejo only".Record each with the hard values. Where one is refused, let it through as the recorded searches are: in
internal/coreruleset/gitea.conf, or inforgejo.conffor the Forgejo-only ones.Pages:
/explore/topics/search;/pulls,/milestones,/issues/search,/repo/search,/user/search_candidatesand/notifications/watching;/org/ORG/issues,/org/ORG/pullsand/org/ORG/milestones, each also with/TEAMafter it, and/org/ORG/teams/-/search;/ORG, exceptls -la, which #349 tracks;/OWNER/-/code,/OWNER/-/projectsand/OWNER/-/packages/TYPE/NAME/versions;/OWNER/REPO/:tags,milestones,milestone/ID,projects,packages,issues/posters,pulls/posters,issues/searchandissues/suggestions;/OWNER/REPO/, Forgejo only:releases, and the code search at a branch or tag,search/branch/BRANCHandsearch/tag/TAG;/admin/actions/runners,/user/settings/actions/runners,/org/ORG/settings/actions/runnersand/OWNER/REPO/settings/actions/runners;/admin/users,/admin/orgs,/admin/repos,/admin/repos/unadopted,/admin/emailsand/admin/packages, andqin the body ofPOST /admin/repos/unadoptedandPOST /admin/emails/activate.Today
drupal.confhasqskip 930120, 932120, 932250 and 932260 on every/admin/path, whatever the app.SWW_APPS(#225) groups each app's fixes by hostname, so gitea's admin pages need their own.At the default settings Forgejo has no code indexer. Without one, the search box on a repository's home page sends its search to
/OWNER/REPO/search/branch/BRANCH. No exclusion ingitea.conforforgejo.confcovers that path.API, under
/api/v1/:repos/search,users/search,repos/issues/search,packages/OWNER,topics/search,orgs/ORG/teams/searchandadmin/emails/search;admin/unadopted, inquery;repos/OWNER/REPO/:issues, andmilestonesinname;repos/OWNER/REPO/, Forgejo only:releasesandactions/jobs/ID/logs.Package registries, under
/api/packages/OWNER/:cargo/api/v1/crates;chef/api/v1/searchandchef/api/v1/cookbooks;composer/search.json;conan/v1/conans/searchandconan/v2/conans/search;nuget/query, andnuget/Search()andnuget/Packages()insearchTermand$filter;npm/-/v1/search, intext./notifications/subscriptionsreads no search. The notification pages' search box is on/notifications/watching.Model: opus-5-5
Scope. This issue is now the Forgejo-only routes, recorded with the hard values and let through in
internal/coreruleset/forgejo.conf:/OWNER/REPO/search/branch/BRANCHand/OWNER/REPO/search/tag/TAG, including the request the home page's search box sends with no code indexer (the default), and/bin/shrecorded there, since branch and tag names can hold a slash;/OWNER/REPO/releasesand/api/v1/repos/OWNER/REPO/releases;/api/v1/repos/OWNER/REPO/actions/jobs/ID/logs.The code search at a branch or tag lets
qthrough as the eighth change does on/OWNER/REPO/search; the release and log searches skip only the rules the recorded values set off. Add the routes toforgejoSearchesand nearby paths toTestForgejoExclusionsAreNarrow, and list them in the fifteenth change inSPEC.md.The rest moved: the shared pages to #352, the API searches to #353, the package registries to #354.
One PR into
next, after #347 lands. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending(closes #350). Label the PRneeds-review.Model: opus-5-5
Also record
/bin/shon each search above for a branch, tag or package name, since those names can hold a slash (feat/docker-support, npm's@scope/name). Record it too on/OWNER/REPO/branchesand/OWNER/-/packages, which #347 records without it.Model: opus-5-5