# The twelfth change: on Vaultwarden's paths, some fields skip the rules that
# refused ordinary Vaultwarden requests there. They are the fields where
# Vaultwarden receives a name, a password hint or an email address in plain
# text, and the names of uploaded files. Each exclusion runs with the request,
# before the rules it switches off, so this file is loaded before the Core Rule
# Set's rules. Each comment names a request a rule refused. An exclusion on a
# field of a body applies only when the query has no parameter of that name, so
# it matters only while SWW_WAF_BODY_LIMIT is set.
#
# The apps encrypt the names, notes, addresses and file names of vault items,
# folders, collections and sends before they send them. These values pass
# without exclusions.
#
# Four rules read a name or a hint as a command or a system file:
#   930120: .htaccess
#   932120: powershell
#   932250: ls -la
#   932260: python3

# Names and password hints, in JSON bodies, skip the four rules:
#   name: signing up, editing the account's profile, and creating or renaming
#   an organization or a group, "python3 .htaccess team"
#   masterPasswordHint: signing up or changing the master password,
#   "the .htaccess one, not powershell"
#   invitation_org_name, smtp_from_name: saving the admin page's settings,
#   "ls -la and .htaccess vault"
# Drupal serves /admin/config too, but sends no JSON there.
SecRule REQUEST_FILENAME "@rx ^/identity/accounts/|^/api/(?:accounts|emergency-access|organizations)(?:/|$)|^/admin/config$" \
    "id:900960,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^json\.(?:name|masterpasswordhint|invitation_org_name|smtp_from_name)$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:name|masterpasswordhint|invitation_org_name|smtp_from_name)$/,\
        ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:name|masterpasswordhint|invitation_org_name|smtp_from_name)$/,\
        ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:name|masterpasswordhint|invitation_org_name|smtp_from_name)$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:name|masterpasswordhint|invitation_org_name|smtp_from_name)$/"

# Email addresses, in bodies, skip 932120 and 932260 only, which refused
# python3.dev@example.com and powershell@example.com:
#   username: signing in at /identity/connect/token, in form data
#   email: signing up, asking for the password hint, inviting an emergency
#   contact, and inviting a user from the admin page
#   salt fields, such as masterPasswordUnlock.salt: signing up and changing
#   the master password, which send the address as the salt
#   newEmail: changing the account's address
#   billingEmail: creating or editing an organization
#   emails: inviting members to an organization
#   smtp_from: saving the admin page's settings
# An address keeps 930120 and 932250, which refuse "ls -la" and a system file.
SecRule REQUEST_FILENAME "@rx ^/identity/(?:connect/token$|accounts/)|^/api/(?:accounts|emergency-access|organizations)(?:/|$)|^/admin/(?:config|invite)$" \
    "id:900961,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^(?:username|json\.(?:email|newemail|billingemail|emails\.\d+|smtp_from|(?:[a-z]+\.)+salt))$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=932120;ARGS:/^(?:username|json\.(?:email|newemail|billingemail|emails\.\d+|smtp_from|(?:[a-z]+\.)+salt))$/,\
        ctl:ruleRemoveTargetById=932260;ARGS:/^(?:username|json\.(?:email|newemail|billingemail|emails\.\d+|smtp_from|(?:[a-z]+\.)+salt))$/"

# The data breach report sends an address in the query, which skips the same
# two rules: /api/hibp/breach?username=powershell%40example.com.
SecRule REQUEST_FILENAME "@rx ^/api/hibp/breach$" \
    "id:900962,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=932120;ARGS:username,\
    ctl:ruleRemoveTargetById=932260;ARGS:username"

# An uploaded attachment or file send is named by its encrypted name, such as
# "2.4Hw+ulOz7BLrP+NSaLKhGw==|9nlpuuYHog6rpJrR...". 920120 refused the "=" in
# it, so the names of uploaded files skip 920120 on these paths:
#   /api/ciphers/<id>/attachment/<attachment id>, and the older uploads to
#   /api/ciphers/<id>/attachment, /api/ciphers/<id>/attachment-admin and
#   /api/ciphers/<id>/attachment/<attachment id>/share
#   /api/sends/<id>/file/<file id>
SecRule REQUEST_FILENAME "@rx ^/api/ciphers/[0-9a-f-]{36}/attachment(?:-admin|/[0-9a-f]+(?:/share)?)?$|^/api/sends/[0-9a-f-]{36}/file/[0-9a-f]+$" \
    "id:900963,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=920120;FILES"