sneak
21f7bf6f23
check / check (push) Failing after 1m34s
gitea's fixes (its parameters, its cookies and gitea.conf) now apply only to a hostname SWW_APPS lists gitea for, or to every hostname while it is unset. Each app's fixes are one .conf file, whose first rule skips the rest unless Inspect sets tx.app_<name>, and one entry in apps. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5
329 lines
14 KiB
Plaintext
329 lines
14 KiB
Plaintext
# gitea's fixes: some fields skip the rules that refused ordinary gitea requests.
|
|
# They are the fields where gitea sends a search, a file name or a branch name.
|
|
# Each exclusion runs with the request, before the rules it switches off, those
|
|
# of phase 1 included, so this file is loaded before the Core Rule Set's rules.
|
|
# Each comment names a request the rule refused.
|
|
|
|
# A request whose hostname SWW_APPS does not list gitea for skips every rule
|
|
# below. Inspect sets tx.app_gitea on the others.
|
|
SecRule &TX:app_gitea "@eq 0" \
|
|
"id:900590,phase:1,pass,nolog,skipAfter:END_GITEA"
|
|
|
|
# The query parameters in which gitea sends names within a repository or its
|
|
# own records, or a page of its own site, are not checked against the lists of
|
|
# system files, shell paths and command names, on any path:
|
|
# 930120: .gitignore
|
|
# 932160: bin/docker-entrypoint
|
|
# 932260: docker-build
|
|
SecAction "id:900591,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:files,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:skip-to,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:sub_path,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:ref,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:sha,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:branch,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:workflow,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:artifactName,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:files,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:skip-to,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:sub_path,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:ref,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:sha,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:branch,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:workflow,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:artifactName,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:files,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:skip-to,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:sub_path,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:ref,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:sha,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:branch,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:workflow,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:artifactName,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:redirect_to"
|
|
|
|
# gitea's searches of code, of issues and pull requests, and of commits send the
|
|
# text searched for in q, which skips these rules there:
|
|
# 930110: ../
|
|
# 930120: .gitignore
|
|
# 931100: http://127.0.0.1:8080
|
|
# 932120: Invoke-WebRequest
|
|
# 932130: $(pwd)
|
|
# 932140: if (a == b) {
|
|
# 932160: /bin/sh
|
|
# 932235: `make check`
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
# 932380: `whoami`
|
|
# 933100: <?php echo
|
|
# 933130: $_GET[
|
|
# 933135: ${VAR}
|
|
# 934100: process.env
|
|
# 934110: http://127.0.0.1:8080
|
|
# 934130: __proto__
|
|
# 941100: <script>
|
|
# 941110: <script>
|
|
# 941160: <img src=
|
|
# 941180: document.cookie
|
|
# 941390: fetch(
|
|
# 942100: SELECT * FROM users WHERE
|
|
# 942140: information_schema
|
|
# 942190: union select
|
|
# 942230: if (a == b) {
|
|
# 944100: java.lang.Runtime
|
|
# 944110: java.lang.Runtime
|
|
# 944130: java.lang.Runtime
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
|
|
[^/]+/-/code|\
|
|
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
|
|
commits/(?:branch|tag|commit)/.+/search)|\
|
|
api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))$" \
|
|
"id:900600,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=931100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932140;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932235;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932380;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933135;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941390;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942190;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942230;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:q"
|
|
|
|
# A page opened from the results of one of those searches has the search's
|
|
# address in Referer, which skips these rules then:
|
|
# 941110: <script>
|
|
# 941120: onClick={
|
|
# 941160: <img src=
|
|
# 942100: LIKE '%foo%'
|
|
# 944100: java.lang.Runtime
|
|
SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
|
|
issues(?:/search)?|pulls|[^/]+/-/code|\
|
|
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
|
|
commits/(?:branch|tag|commit)/.+/search)|\
|
|
api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))\?" \
|
|
"id:900601,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
|
|
|
|
# gitea's searches of repositories, users, branches, tags and packages send a
|
|
# name in q, which skips these rules there:
|
|
# 930120: .profile
|
|
# 932120: powershell-scripts
|
|
# 932260: python3-app
|
|
# 944130: org.apache.commons.logging
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
|
|
[^/]+/-/packages|[^/]+/[^/]+/(?:branches|tags)|api/v1/repos/search)$" \
|
|
"id:900602,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:q"
|
|
|
|
# gitea's other searches for a name send it in q too, which skips only these
|
|
# rules there:
|
|
# 930120: .profile
|
|
# 932120: powershell-scripts
|
|
# 932260: python3-app
|
|
# The searches:
|
|
# - the dashboard's filter of repositories;
|
|
# - the repositories on a user's or an organisation's page, whose path has
|
|
# one segment;
|
|
# - the author filter of the issue and pull request lists;
|
|
# - the lists of users and organisations, and the API's search for users.
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+|repo/search|\
|
|
explore/(?:users|organizations)|api/v1/users/search|\
|
|
[^/]+/[^/]+/(?:issues|pulls)/posters)$" \
|
|
"id:900603,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# These requests name a file in the path, which skips these rules there:
|
|
# 920500: notes.txt~
|
|
# 934100: process.env.d.ts
|
|
# 941130: docs/a b.xhtml
|
|
# 944130: java.lang.String.md
|
|
# The requests:
|
|
# - a file's page, raw file and download;
|
|
# - its blame, history, edit, preview and delete pages;
|
|
# - the API's call for its contents;
|
|
# - a release attachment's download.
|
|
SecRule REQUEST_FILENAME \
|
|
"@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_preview|_delete|contents|releases/download)/" \
|
|
"id:900610,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=920500;REQUEST_FILENAME,\
|
|
ctl:ruleRemoveTargetById=934100;REQUEST_FILENAME,\
|
|
ctl:ruleRemoveTargetById=941130;REQUEST_FILENAME,\
|
|
ctl:ruleRemoveTargetById=944130;REQUEST_FILENAME"
|
|
|
|
# The requests below name a file in a query parameter. These rules refused
|
|
# them for the file named:
|
|
# 930120: .gitignore
|
|
# 932120: install-script.sh
|
|
# 932130: [draft].md
|
|
# 932160: bin/docker-entrypoint
|
|
# 932260: docker-compose.yml
|
|
# 934100: process.env.d.ts
|
|
# 934130: __proto__.json
|
|
# 941130: index.xhtml
|
|
# 941180: document.write.js
|
|
# 942140: information_schema.sql
|
|
# 944110: java/lang/Runtime.java
|
|
# 944130: java.lang.String.md
|
|
# Each request skips the rules that refused it. Rule 900591 already has path and
|
|
# redirect_to skip 930120, 932160 and 932260 on every path.
|
|
|
|
# A file's commit graph, in file.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/graph$" \
|
|
"id:900620,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:file"
|
|
|
|
# The API's list of a file's commits, in path.
|
|
SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/commits$" \
|
|
"id:900621,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:path"
|
|
|
|
# The API's call for the contents of several files, in body, as JSON.
|
|
SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/file-contents$" \
|
|
"id:900622,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:body"
|
|
|
|
# An issue opened from a template, in template.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/issues/new$" \
|
|
"id:900623,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=932130;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:template"
|
|
|
|
# The sign-in page on the way to a file's edit page, in redirect_to.
|
|
SecRule REQUEST_FILENAME "@rx ^/user/login$" \
|
|
"id:900624,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=932130;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:redirect_to"
|
|
|
|
# An attachment uploaded through the API to a release, an issue or a comment,
|
|
# in name.
|
|
SecRule REQUEST_FILENAME \
|
|
"@rx ^/api/v1/repos/[^/]+/[^/]+/(?:releases|issues|issues/comments)/[0-9]+/assets$" \
|
|
"id:900625,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:name"
|
|
|
|
# A diff's hidden lines, fetched when shown, in path.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/blob_excerpt/[0-9a-f]+$" \
|
|
"id:900626,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:path"
|
|
|
|
# The requests below name a branch or tag in a query parameter, which skips
|
|
# the list of command names (932260) there. It refused names such as
|
|
# docker-build, python3-migration and feat/docker-support.
|
|
|
|
# Deleting or restoring a branch, in name.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/(?:delete|restore)$" \
|
|
"id:900630,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:name"
|
|
|
|
# A release started from a tag, in tag.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/releases/new$" \
|
|
"id:900631,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:tag"
|
|
|
|
# A branch protection rule opened for editing, in rule_name.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/branches/edit$" \
|
|
"id:900632,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:rule_name"
|
|
|
|
# A directory listing's last commits, in refSubUrl.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/lastcommit/" \
|
|
"id:900633,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:refSubUrl"
|
|
|
|
# An artifact upload from actions/upload-artifact@v3 sends the header
|
|
# Content-Range, which the Core Rule Set refused (920450).
|
|
SecRule REQUEST_FILENAME \
|
|
"@rx ^/api/actions_pipeline/_apis/pipelines/workflows/[0-9]+/artifacts/[^/]+/upload$" \
|
|
"id:900640,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=920450;REQUEST_HEADERS_NAMES:Content-Range"
|
|
|
|
SecMarker END_GITEA
|