# The fifteenth change: on Forgejo's paths, some fields skip the rules that
# refused ordinary Forgejo requests there. Forgejo is a fork of gitea, and the
# eighth change's fixes for gitea apply to its requests too, so this file holds
# only what Forgejo sends and gitea does not. Each exclusion runs with the
# request, before the rules it switches off, so this file is loaded before the
# Core Rule Set's rules. Each comment names a request the rule refused.

# Forgejo's search of a wiki sends the text searched for in q, which skips
# these rules there:
#   930120: .htaccess
#   932120: powershell
#   932160: /bin/sh
#   932250: ls -la
#   932260: python3
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
    "id:900680,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:q,\
    ctl:ruleRemoveTargetById=932120;ARGS:q,\
    ctl:ruleRemoveTargetById=932160;ARGS:q,\
    ctl:ruleRemoveTargetById=932250;ARGS:q,\
    ctl:ruleRemoveTargetById=932260;ARGS:q"

# Forgejo's search of a repository's code at a branch or a tag sends the text
# searched for in q. The search box on a repository's home page sends it there
# when Forgejo has no code indexer, as by default. A branch or tag name can
# hold a slash, as feat/docker-support does. q skips there the rules it skips
# on gitea's search of code (900600 in gitea.conf). Among them, these refused
# Forgejo's searches there:
#   930120: .htaccess
#   932120: powershell
#   932160: /bin/sh
#   932250: ls -la
#   932260: python3
# Forgejo has no owner named api, so a path under /api/ gets none of this.
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/search/(?:branch|tag)/.+$" \
    "id:900681,phase:1,pass,nolog,chain"
    SecRule REQUEST_FILENAME "!@rx ^/api/" \
        "ctl:ruleRemoveTargetById=930110;ARGS:q,\
        ctl:ruleRemoveTargetById=930120;ARGS:q,\
        ctl:ruleRemoveTargetById=931100;ARGS:q,\
        ctl:ruleRemoveTargetById=932120;ARGS:q,\
        ctl:ruleRemoveTargetById=932130;ARGS:q,\
        ctl:ruleRemoveTargetById=932140;ARGS:q,\
        ctl:ruleRemoveTargetById=932160;ARGS:q,\
        ctl:ruleRemoveTargetById=932235;ARGS:q,\
        ctl:ruleRemoveTargetById=932250;ARGS:q,\
        ctl:ruleRemoveTargetById=932260;ARGS:q,\
        ctl:ruleRemoveTargetById=932380;ARGS:q,\
        ctl:ruleRemoveTargetById=933100;ARGS:q,\
        ctl:ruleRemoveTargetById=933130;ARGS:q,\
        ctl:ruleRemoveTargetById=933135;ARGS:q,\
        ctl:ruleRemoveTargetById=934100;ARGS:q,\
        ctl:ruleRemoveTargetById=934110;ARGS:q,\
        ctl:ruleRemoveTargetById=934130;ARGS:q,\
        ctl:ruleRemoveTargetById=941100;ARGS:q,\
        ctl:ruleRemoveTargetById=941110;ARGS:q,\
        ctl:ruleRemoveTargetById=941160;ARGS:q,\
        ctl:ruleRemoveTargetById=941180;ARGS:q,\
        ctl:ruleRemoveTargetById=941390;ARGS:q,\
        ctl:ruleRemoveTargetById=942100;ARGS:q,\
        ctl:ruleRemoveTargetById=942140;ARGS:q,\
        ctl:ruleRemoveTargetById=942190;ARGS:q,\
        ctl:ruleRemoveTargetById=942230;ARGS:q,\
        ctl:ruleRemoveTargetById=944100;ARGS:q,\
        ctl:ruleRemoveTargetById=944110;ARGS:q,\
        ctl:ruleRemoveTargetById=944130;ARGS:q"

# A page opened from the results of that search has the search's address in
# Referer, which skips these rules then, as after gitea's searches (900601 in
# gitea.conf):
#   941110: <script>
#   941120: onClick={
#   941160: <img src=
#   942100: LIKE '%foo%'
#   944100: java.lang.Runtime
# A path under /api/ is left out here too.
SecRule REQUEST_HEADERS:Referer \
    "@rx ^https?://[^/]+/[^/]+/[^/]+/search/(?:branch|tag)/[^?]+\?" \
    "id:900684,phase:1,pass,nolog,chain"
    SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/" \
        "ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
        ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
        ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
        ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
        ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"

# Forgejo's search of a repository's releases, on its page and in the API,
# matches q against each release's title and tag. A tag name can hold a slash.
# q skips these rules there:
#   930120: .htaccess
#   932120: powershell
#   932160: /bin/sh
#   932250: ls -la
#   932260: python3
# Forgejo has no owner named api, so /api/v1/releases is not one.
SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/releases$" \
    "id:900682,phase:1,pass,nolog,chain"
    SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/releases$" \
        "ctl:ruleRemoveTargetById=930120;ARGS:q,\
        ctl:ruleRemoveTargetById=932120;ARGS:q,\
        ctl:ruleRemoveTargetById=932160;ARGS:q,\
        ctl:ruleRemoveTargetById=932250;ARGS:q,\
        ctl:ruleRemoveTargetById=932260;ARGS:q"

# The API's search of a job's log sends the text searched for in q, which
# skips these rules there:
#   930120: .htaccess
#   932120: powershell
#   932250: ls -la
#   932260: python3
SecRule REQUEST_FILENAME \
    "@rx ^/api/v1/repos/[^/]+/[^/]+/actions/jobs/[0-9]+/logs$" \
    "id:900683,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:q,\
    ctl:ruleRemoveTargetById=932120;ARGS:q,\
    ctl:ruleRemoveTargetById=932250;ARGS:q,\
    ctl:ruleRemoveTargetById=932260;ARGS:q"