clawbot
36c4f91583
check / check (push) Waiting to run
Applies the setting renames of the naming audit under the SWW_WAF_ and SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache time and the two time limits, which now take milliseconds. The rproxy log field default_disposition becomes waf_backend_no_answer, and config.Config and config.FromEnvironment become config.WAF and config.WAFFromEnvironment. Go fields, test names and prose follow. No aliases; nothing reads the old names. Model: opus-5-5
146 lines
6.5 KiB
Plaintext
146 lines
6.5 KiB
Plaintext
# Forgejo's fixes: on Forgejo's paths, some fields skip the rules that refused
|
|
# ordinary Forgejo requests there. Forgejo is a fork of gitea. A hostname that
|
|
# gets Forgejo's fixes gets gitea's too, so this file holds only what Forgejo
|
|
# sends and gitea does not. Each exclusion runs with the request, before the
|
|
# rules it switches off, so this file is loaded before the Core Rule Set's
|
|
# rules. Each comment names a request the rule refused.
|
|
|
|
# Every rule below is skipped unless Inspect has set tx.app_forgejo. It sets it
|
|
# while SWW_WAF_APPS is unset, or lists forgejo for the request's hostname.
|
|
# The skip reaches only phase 1, so a rule of a later phase must check
|
|
# tx.app_forgejo itself.
|
|
SecRule &TX:app_forgejo "@eq 0" \
|
|
"id:900670,phase:1,pass,nolog,skipAfter:END_FORGEJO"
|
|
|
|
# Forgejo's search of a wiki sends the text searched for in q, which skips
|
|
# these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
|
|
"id:900680,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Forgejo's search of a repository's code at a branch or a tag sends the text
|
|
# searched for in q. The search box on a repository's home page sends it there
|
|
# when Forgejo has no code indexer, as by default. A branch or tag name can
|
|
# hold a slash, as feat/docker-support does. q skips there the rules it skips
|
|
# on gitea's search of code (900600 in gitea.conf). Among them, these refused
|
|
# Forgejo's searches there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
# Forgejo has no owner named api, so a path under /api/ gets none of this.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/search/(?:branch|tag)/.+$" \
|
|
"id:900681,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_FILENAME "!@rx ^/api/" \
|
|
"ctl:ruleRemoveTargetById=930110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=931100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932140;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932235;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932380;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933135;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941390;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942190;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942230;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:q"
|
|
|
|
# A page opened from the results of that search has the search's address in
|
|
# Referer, which skips these rules then, as after gitea's searches (900601 in
|
|
# gitea.conf):
|
|
# 941110: <script>
|
|
# 941120: onClick={
|
|
# 941160: <img src=
|
|
# 942100: LIKE '%foo%'
|
|
# 944100: java.lang.Runtime
|
|
# A path under /api/ is left out here too.
|
|
SecRule REQUEST_HEADERS:Referer \
|
|
"@rx ^https?://[^/]+/[^/]+/[^/]+/search/(?:branch|tag)/[^?]+\?" \
|
|
"id:900684,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/" \
|
|
"ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
|
|
|
|
# Forgejo's search of a repository's releases, on its page and in the API,
|
|
# matches q against each release's title and tag. A tag name can hold a slash.
|
|
# q skips these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
# Forgejo has no owner named api, so /api/v1/releases is not one.
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/releases$" \
|
|
"id:900682,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/releases$" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# The API's search of a job's log sends the text searched for in q, which
|
|
# skips these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
SecRule REQUEST_FILENAME \
|
|
"@rx ^/api/v1/repos/[^/]+/[^/]+/actions/jobs/[0-9]+/logs$" \
|
|
"id:900683,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Forgejo's admin page searches the names of repositories in q on /admin/repos,
|
|
# which skips the list of command names (932260) there. It refused python3.
|
|
SecRule REQUEST_FILENAME "@streq /admin/repos" \
|
|
"id:900691,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Forgejo renames a branch on its own path, where from and to name branches.
|
|
# They skip these rules:
|
|
# 932120: fix-powershell-module
|
|
# 932260: feat/docker-support
|
|
# They are read only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set, and skip
|
|
# nothing when the query has a parameter of the same name.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/rename_branch$" \
|
|
"id:900666,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=932120;ARGS:from,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:from,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:to,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:to"
|
|
|
|
SecMarker END_FORGEJO
|