# The Core Rule Set's exclusions for Gitea, which servewaf loads from
# SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE. Each switches one rule off for the
# Gitea fields or paths where it refused ordinary Gitea requests. Gitea
# sends these in the query string:
#   - q: the text of every search;
#   - file, path, template, body and redirect_to: a file name, alone or in
#     JSON or a link;
#   - name, tag, rule_name and refSubUrl: a branch or tag name.
# docs/gitea.md says how to add an exclusion.

# Searches.
# 930110: a search for ../
SecRuleUpdateTargetById 930110 "!ARGS:q"
# 931100: a search for http://127.0.0.1:8080
SecRuleUpdateTargetById 931100 "!ARGS:q"
# 932140: a search for if (a == b) {
SecRuleUpdateTargetById 932140 "!ARGS:q"
# 932235: a search for `make check`
SecRuleUpdateTargetById 932235 "!ARGS:q"
# 932250: a search for ls -la
SecRuleUpdateTargetById 932250 "!ARGS:q"
# 932380: a search for `whoami`
SecRuleUpdateTargetById 932380 "!ARGS:q"
# 933135: a search for ${VAR}
SecRuleUpdateTargetById 933135 "!ARGS:q"
# 934110: a search for http://127.0.0.1:8080
SecRuleUpdateTargetById 934110 "!ARGS:q"
# 941100: a search for <script>
SecRuleUpdateTargetById 941100 "!ARGS:q"
# 941110: a search for <script>, or a page opened from its results
SecRuleUpdateTargetById 941110 "!ARGS:q|!REQUEST_HEADERS:Referer"
# 941160: a search for <img src=, or a page opened from its results
SecRuleUpdateTargetById 941160 "!ARGS:q|!REQUEST_HEADERS:Referer"
# 941390: a search for fetch(
SecRuleUpdateTargetById 941390 "!ARGS:q"
# 942100: a search for SELECT * FROM users WHERE
SecRuleUpdateTargetById 942100 "!ARGS:q"
# 942190: a search for union select
SecRuleUpdateTargetById 942190 "!ARGS:q"
# 942230: a search for if (a == b) {
SecRuleUpdateTargetById 942230 "!ARGS:q"
# 944100: a search for java.lang.Runtime, or a page opened from its results
SecRuleUpdateTargetById 944100 "!ARGS:q|!REQUEST_HEADERS:Referer"

# Searches, and file, branch and tag names.
# 930120: a search for package.json, or the commit graph of .gitignore
SecRuleUpdateTargetById 930120 "!ARGS:q|!ARGS:file|!ARGS:template|!ARGS:body|\
    !ARGS:refSubUrl|!ARGS:name|!ARGS:tag|!ARGS:rule_name"
# 932160: a search for /bin/sh, or the API's contents of bin/docker-entrypoint
SecRuleUpdateTargetById 932160 "!ARGS:q|!ARGS:file|!ARGS:template|!ARGS:body|\
    !ARGS:refSubUrl|!ARGS:name|!ARGS:tag|!ARGS:rule_name"
# 932260: a search for python3, or deleting the branch docker-build
SecRuleUpdateTargetById 932260 "!ARGS:q|!ARGS:file|!ARGS:template|!ARGS:body|\
    !ARGS:refSubUrl|!ARGS:name|!ARGS:tag|!ARGS:rule_name"

# Searches, and file names in the query string.
# 932120: a search for Invoke-WebRequest, or the commits of install-script.sh
SecRuleUpdateTargetById 932120 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
    !ARGS:body|!ARGS:redirect_to"
# 932130: a search for $(pwd), or an issue opened from the template [draft].md
SecRuleUpdateTargetById 932130 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
    !ARGS:body|!ARGS:redirect_to"
# 934100: a search for process.env, or the commits of process.env.d.ts
SecRuleUpdateTargetById 934100 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
    !ARGS:body|!ARGS:redirect_to"
# 934130: a search for __proto__, or the commits of __proto__.json
SecRuleUpdateTargetById 934130 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
    !ARGS:body|!ARGS:redirect_to"
# 941130: the commits of index.xhtml
SecRuleUpdateTargetById 941130 "!ARGS:file|!ARGS:path|!ARGS:template|\
    !ARGS:body|!ARGS:redirect_to"
# 941180: a search for document.cookie, or the commits of document.write.js
SecRuleUpdateTargetById 941180 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
    !ARGS:body|!ARGS:redirect_to"
# 942140: the commits of information_schema.sql
SecRuleUpdateTargetById 942140 "!ARGS:file|!ARGS:path|!ARGS:template|\
    !ARGS:body|!ARGS:redirect_to"
# 944110: a search for java.lang.Runtime, or the commits of Runtime.java
SecRuleUpdateTargetById 944110 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
    !ARGS:body|!ARGS:redirect_to"
# 944130: a search for java.lang.Runtime, the commits of java.lang.String.md,
# or any page opened from that file's page, which names it in the Referer
SecRuleUpdateTargetById 944130 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
    !ARGS:body|!ARGS:redirect_to|!REQUEST_HEADERS:Referer"

# File names in the path of a file's page, raw file, blame, history and edit
# page, and of the API's calls for its contents.
# 934100: the page of process.env.d.ts
SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_delete|contents)/" \
    "id:10001,phase:1,pass,nolog,ctl:ruleRemoveTargetById=934100;REQUEST_FILENAME"
# 941130: the page of docs/a b.xhtml
SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_delete|contents)/" \
    "id:10002,phase:1,pass,nolog,ctl:ruleRemoveTargetById=941130;REQUEST_FILENAME"
# 944130: the page of java.lang.String.md
SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_delete|contents)/" \
    "id:10003,phase:1,pass,nolog,ctl:ruleRemoveTargetById=944130;REQUEST_FILENAME"