# The eighth change: on gitea's own paths, the fields in which gitea sends a
# search, a file name or a branch name skip the rules that refused ordinary
# gitea requests there. Each exclusion runs with the request, before the rules
# it switches off, those of phase 1 included, so this file is loaded before the
# Core Rule Set's rules. Each comment names a request the rule refused.

# gitea's searches send the text searched for in q: searches of code, of issues
# and pull requests, of commits, and of repositories, branches, tags, packages
# and users. q skips these rules there:
#   930110: ../
#   930120: .gitignore
#   931100: http://127.0.0.1:8080
#   932120: Invoke-WebRequest
#   932130: $(pwd)
#   932140: if (a == b) {
#   932160: /bin/sh
#   932235: `make check`
#   932250: ls -la
#   932260: python3
#   932380: `whoami`
#   933100: <?php echo
#   933130: $_GET[
#   933135: ${VAR}
#   934100: process.env
#   934110: http://127.0.0.1:8080
#   934130: __proto__
#   941100: <script>
#   941110: <script>
#   941160: <img src=
#   941180: document.cookie
#   941390: fetch(
#   942100: SELECT * FROM users WHERE
#   942140: information_schema
#   942190: union select
#   942230: if (a == b) {
#   944100: java.lang.Runtime
#   944110: java.lang.Runtime
#   944130: java.lang.Runtime
SecRule REQUEST_FILENAME "@rx ^/(?:explore/(?:repos|code)|issues(?:/search)?|pulls|\
    user/search_candidates|[^/]+/-/(?:code|packages)|\
    [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|branches|tags|\
    commits/(?:branch|tag|commit)/.+/search)|\
    api/v1/repos/(?:search|issues/search|[^/]+/[^/]+/issues))$" \
    "id:900600,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930110;ARGS:q,\
    ctl:ruleRemoveTargetById=930120;ARGS:q,\
    ctl:ruleRemoveTargetById=931100;ARGS:q,\
    ctl:ruleRemoveTargetById=932120;ARGS:q,\
    ctl:ruleRemoveTargetById=932130;ARGS:q,\
    ctl:ruleRemoveTargetById=932140;ARGS:q,\
    ctl:ruleRemoveTargetById=932160;ARGS:q,\
    ctl:ruleRemoveTargetById=932235;ARGS:q,\
    ctl:ruleRemoveTargetById=932250;ARGS:q,\
    ctl:ruleRemoveTargetById=932260;ARGS:q,\
    ctl:ruleRemoveTargetById=932380;ARGS:q,\
    ctl:ruleRemoveTargetById=933100;ARGS:q,\
    ctl:ruleRemoveTargetById=933130;ARGS:q,\
    ctl:ruleRemoveTargetById=933135;ARGS:q,\
    ctl:ruleRemoveTargetById=934100;ARGS:q,\
    ctl:ruleRemoveTargetById=934110;ARGS:q,\
    ctl:ruleRemoveTargetById=934130;ARGS:q,\
    ctl:ruleRemoveTargetById=941100;ARGS:q,\
    ctl:ruleRemoveTargetById=941110;ARGS:q,\
    ctl:ruleRemoveTargetById=941160;ARGS:q,\
    ctl:ruleRemoveTargetById=941180;ARGS:q,\
    ctl:ruleRemoveTargetById=941390;ARGS:q,\
    ctl:ruleRemoveTargetById=942100;ARGS:q,\
    ctl:ruleRemoveTargetById=942140;ARGS:q,\
    ctl:ruleRemoveTargetById=942190;ARGS:q,\
    ctl:ruleRemoveTargetById=942230;ARGS:q,\
    ctl:ruleRemoveTargetById=944100;ARGS:q,\
    ctl:ruleRemoveTargetById=944110;ARGS:q,\
    ctl:ruleRemoveTargetById=944130;ARGS:q"

# A page opened from the results of one of those searches has the search's
# address in Referer, which skips these rules then:
#   941110: <script>
#   941120: onClick={
#   941160: <img src=
#   942100: LIKE '%foo%'
#   944100: java.lang.Runtime
SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/(?:repos|code)|\
    issues(?:/search)?|pulls|user/search_candidates|[^/]+/-/(?:code|packages)|\
    [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|branches|tags|\
    commits/(?:branch|tag|commit)/.+/search)|\
    api/v1/repos/(?:search|issues/search|[^/]+/[^/]+/issues))\?" \
    "id:900601,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
    ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
    ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
    ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
    ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"

# A file's page, raw file and download, its blame, history, edit and delete
# pages, and the API's call for its contents name the file in the path, which
# skips these rules there:
#   920500: notes.txt~
#   934100: process.env.d.ts
#   941130: docs/a b.xhtml
#   944130: java.lang.String.md
SecRule REQUEST_FILENAME \
    "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_delete|contents)/" \
    "id:900610,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=920500;REQUEST_FILENAME,\
    ctl:ruleRemoveTargetById=934100;REQUEST_FILENAME,\
    ctl:ruleRemoveTargetById=941130;REQUEST_FILENAME,\
    ctl:ruleRemoveTargetById=944130;REQUEST_FILENAME"

# The requests below name a file in a query parameter. These rules refused
# them for the file named:
#   930120: .gitignore
#   932120: install-script.sh
#   932130: [draft].md
#   932160: bin/docker-entrypoint
#   932260: docker-compose.yml
#   934100: process.env.d.ts
#   934130: __proto__.json
#   941130: index.xhtml
#   941180: document.write.js
#   942140: information_schema.sql
#   944110: java/lang/Runtime.java
#   944130: java.lang.String.md
# Each request skips the rules that refused it. The fourth change already has
# path and redirect_to skip 930120, 932160 and 932260 on every path.

# A file's commit graph, in file.
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/graph$" \
    "id:900620,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:file,\
    ctl:ruleRemoveTargetById=932120;ARGS:file,\
    ctl:ruleRemoveTargetById=932160;ARGS:file,\
    ctl:ruleRemoveTargetById=932260;ARGS:file,\
    ctl:ruleRemoveTargetById=934100;ARGS:file,\
    ctl:ruleRemoveTargetById=934130;ARGS:file,\
    ctl:ruleRemoveTargetById=941130;ARGS:file,\
    ctl:ruleRemoveTargetById=941180;ARGS:file,\
    ctl:ruleRemoveTargetById=942140;ARGS:file,\
    ctl:ruleRemoveTargetById=944110;ARGS:file,\
    ctl:ruleRemoveTargetById=944130;ARGS:file"

# The API's list of a file's commits, in path.
SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/commits$" \
    "id:900621,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=932120;ARGS:path,\
    ctl:ruleRemoveTargetById=934100;ARGS:path,\
    ctl:ruleRemoveTargetById=934130;ARGS:path,\
    ctl:ruleRemoveTargetById=941130;ARGS:path,\
    ctl:ruleRemoveTargetById=941180;ARGS:path,\
    ctl:ruleRemoveTargetById=942140;ARGS:path,\
    ctl:ruleRemoveTargetById=944110;ARGS:path,\
    ctl:ruleRemoveTargetById=944130;ARGS:path"

# The API's call for the contents of several files, in body, as JSON.
SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/file-contents$" \
    "id:900622,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:body,\
    ctl:ruleRemoveTargetById=932120;ARGS:body,\
    ctl:ruleRemoveTargetById=932160;ARGS:body,\
    ctl:ruleRemoveTargetById=934100;ARGS:body,\
    ctl:ruleRemoveTargetById=934130;ARGS:body,\
    ctl:ruleRemoveTargetById=941130;ARGS:body,\
    ctl:ruleRemoveTargetById=941180;ARGS:body,\
    ctl:ruleRemoveTargetById=942140;ARGS:body,\
    ctl:ruleRemoveTargetById=944110;ARGS:body,\
    ctl:ruleRemoveTargetById=944130;ARGS:body"

# An issue opened from a template, in template.
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/issues/new$" \
    "id:900623,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:template,\
    ctl:ruleRemoveTargetById=932120;ARGS:template,\
    ctl:ruleRemoveTargetById=932130;ARGS:template,\
    ctl:ruleRemoveTargetById=932160;ARGS:template,\
    ctl:ruleRemoveTargetById=932260;ARGS:template,\
    ctl:ruleRemoveTargetById=934100;ARGS:template,\
    ctl:ruleRemoveTargetById=934130;ARGS:template,\
    ctl:ruleRemoveTargetById=941130;ARGS:template,\
    ctl:ruleRemoveTargetById=941180;ARGS:template,\
    ctl:ruleRemoveTargetById=942140;ARGS:template,\
    ctl:ruleRemoveTargetById=944110;ARGS:template,\
    ctl:ruleRemoveTargetById=944130;ARGS:template"

# The sign-in page on the way to a file's edit page, in redirect_to.
SecRule REQUEST_FILENAME "@rx ^/user/login$" \
    "id:900624,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=932120;ARGS:redirect_to,\
    ctl:ruleRemoveTargetById=932130;ARGS:redirect_to,\
    ctl:ruleRemoveTargetById=934100;ARGS:redirect_to,\
    ctl:ruleRemoveTargetById=934130;ARGS:redirect_to,\
    ctl:ruleRemoveTargetById=941130;ARGS:redirect_to,\
    ctl:ruleRemoveTargetById=941180;ARGS:redirect_to,\
    ctl:ruleRemoveTargetById=942140;ARGS:redirect_to,\
    ctl:ruleRemoveTargetById=944110;ARGS:redirect_to,\
    ctl:ruleRemoveTargetById=944130;ARGS:redirect_to"

# An attachment uploaded through the API to a release, an issue or a comment,
# in name.
SecRule REQUEST_FILENAME \
    "@rx ^/api/v1/repos/[^/]+/[^/]+/(?:releases|issues|issues/comments)/[0-9]+/assets$" \
    "id:900625,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:name,\
    ctl:ruleRemoveTargetById=932120;ARGS:name,\
    ctl:ruleRemoveTargetById=932260;ARGS:name,\
    ctl:ruleRemoveTargetById=934100;ARGS:name,\
    ctl:ruleRemoveTargetById=934130;ARGS:name,\
    ctl:ruleRemoveTargetById=941130;ARGS:name,\
    ctl:ruleRemoveTargetById=941180;ARGS:name,\
    ctl:ruleRemoveTargetById=942140;ARGS:name,\
    ctl:ruleRemoveTargetById=944130;ARGS:name"

# The requests below name a branch or tag in a query parameter, which skips
# the list of command names (932260) there. It refused names such as
# docker-build, python3-migration and feat/docker-support.

# Deleting or restoring a branch, in name.
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/(?:delete|restore)$" \
    "id:900630,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:name"

# A release started from a tag, in tag.
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/releases/new$" \
    "id:900631,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:tag"

# A branch protection rule opened for editing, in rule_name.
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/branches/edit$" \
    "id:900632,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:rule_name"

# A directory listing's last commits, in refSubUrl.
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/lastcommit/" \
    "id:900633,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:refSubUrl"

# An artifact upload from actions/upload-artifact@v3 sends the header
# Content-Range, which the Core Rule Set refused (920450).
SecRule REQUEST_FILENAME \
    "@rx ^/api/actions_pipeline/_apis/pipelines/workflows/[0-9]+/artifacts/[^/]+/upload$" \
    "id:900640,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=920450;REQUEST_HEADERS_NAMES:Content-Range"