clawbot
0cb6dded98
check / check (push) Waiting to run
Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
146 lines
6.4 KiB
Plaintext
146 lines
6.4 KiB
Plaintext
# Forgejo's fixes: on Forgejo's paths, some fields skip the rules that refused
|
|
# ordinary Forgejo requests there. Forgejo is a fork of gitea. A hostname that
|
|
# gets Forgejo's fixes gets gitea's too, so this file holds only what Forgejo
|
|
# sends and gitea does not. Each exclusion runs with the request, before the
|
|
# rules it switches off, so this file is loaded before the Core Rule Set's
|
|
# rules. Each comment names a request the rule refused.
|
|
|
|
# Every rule below is skipped unless Inspect has set tx.app_forgejo. It sets it
|
|
# while SWW_WAF_APPS is unset, or lists forgejo for the request's hostname.
|
|
# The skip reaches only phase 1, so a rule of a later phase must check
|
|
# tx.app_forgejo itself.
|
|
SecRule &TX:app_forgejo "@eq 0" \
|
|
"id:900670,phase:1,pass,nolog,skipAfter:END_FORGEJO"
|
|
|
|
# Forgejo's search of a wiki sends the text searched for in q, which skips
|
|
# these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
|
|
"id:900680,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Forgejo's search of a repository's code at a branch or a tag sends the text
|
|
# searched for in q. The search box on a repository's home page sends it there
|
|
# when Forgejo has no code indexer, as by default. A branch or tag name can
|
|
# hold a slash, as feat/docker-support does. q skips there the rules it skips
|
|
# on gitea's search of code (900600 in gitea.conf). Among them, these refused
|
|
# Forgejo's searches there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
# Forgejo has no owner named api, so a path under /api/ gets none of this.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/search/(?:branch|tag)/.+$" \
|
|
"id:900681,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_FILENAME "!@rx ^/api/" \
|
|
"ctl:ruleRemoveTargetById=930110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=931100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932140;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932235;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932380;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933135;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941390;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942190;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942230;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:q"
|
|
|
|
# A page opened from the results of that search has the search's address in
|
|
# Referer, which skips these rules then, as after gitea's searches (900601 in
|
|
# gitea.conf):
|
|
# 941110: <script>
|
|
# 941120: onClick={
|
|
# 941160: <img src=
|
|
# 942100: LIKE '%foo%'
|
|
# 944100: java.lang.Runtime
|
|
# A path under /api/ is left out here too.
|
|
SecRule REQUEST_HEADERS:Referer \
|
|
"@rx ^https?://[^/]+/[^/]+/[^/]+/search/(?:branch|tag)/[^?]+\?" \
|
|
"id:900684,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/" \
|
|
"ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
|
|
|
|
# Forgejo's search of a repository's releases, on its page and in the API,
|
|
# matches q against each release's title and tag. A tag name can hold a slash.
|
|
# q skips these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
# Forgejo has no owner named api, so /api/v1/releases is not one.
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/releases$" \
|
|
"id:900682,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/releases$" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# The API's search of a job's log sends the text searched for in q, which
|
|
# skips these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
SecRule REQUEST_FILENAME \
|
|
"@rx ^/api/v1/repos/[^/]+/[^/]+/actions/jobs/[0-9]+/logs$" \
|
|
"id:900683,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Forgejo's admin page searches the names of repositories in q on /admin/repos,
|
|
# which skips the list of command names (932260) there. It refused python3.
|
|
SecRule REQUEST_FILENAME "@streq /admin/repos" \
|
|
"id:900691,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Forgejo renames a branch on its own path, where from and to name branches.
|
|
# They skip these rules:
|
|
# 932120: fix-powershell-module
|
|
# 932260: feat/docker-support
|
|
# They are read only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, and skip
|
|
# nothing when the query has a parameter of the same name.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/rename_branch$" \
|
|
"id:900666,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=932120;ARGS:from,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:from,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:to,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:to"
|
|
|
|
SecMarker END_FORGEJO
|