sneak/smallwebwaf
1
0 Fork 0
Code Issues 21 Pull Requests 6 Actions 1 Packages Projects Releases Wiki Activity

Core Rule Set: gitea's search Referer exclusion skips /api/v2/search (closes #270) #272

Merged
clawbot merged 1 commits from issue-270-referer-api-exclusion into next 2026-11-10 04:26:09 +01:00
Conversation 4 Commits 1 Files Changed 2
+17 -6
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/coreruleset/coreruleset_test.go
+8
View File
@@ -692,6 +692,14 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
t.Errorf("%s let through: %+v", target, got) t.Errorf("%s let through: %+v", target, got)
} }
} }
// Nor is a page opened from them.
for _, attack := range []string{scriptTag, injection} {
referer := "Referer: https://example.com" + path + "?q=" + attack
if got := inspect(t, crs, get("/", referer)); got.Score < threshold {
t.Errorf("%s let through: %+v", referer, got)
}
}
} }
} }
internal/coreruleset/gitea.conf
+9 -6
View File
@@ -83,17 +83,20 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
# 941160: <img src= # 941160: <img src=
# 942100: LIKE '%foo%' # 942100: LIKE '%foo%'
# 944100: java.lang.Runtime # 944100: java.lang.Runtime
# A repository with the owner api is left out here too.
SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\ SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
issues(?:/search)?|pulls|[^/]+/-/code|\ issues(?:/search)?|pulls|[^/]+/-/code|\
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\ [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
commits/(?:branch|tag|commit)/.+/search)|\ commits/(?:branch|tag|commit)/.+/search)|\
api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))\?" \ api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))\?" \
"id:900601,phase:1,pass,nolog,\ "id:900601,phase:1,pass,nolog,chain"
ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\ SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/[^/]+/(?:search|\
ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\ issues(?:/search)?|pulls|commits/(?:branch|tag|commit)/.+/search)\?" \
ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\ "ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\ ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer" ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
# gitea's searches of repositories, users, branches, tags and packages send a # gitea's searches of repositories, users, branches, tags and packages send a
# name in q, which skips these rules there: # name in q, which skips these rules there: