sneak
4470596886
check / check (push) Waiting to run
Each app's fixes are one .conf file and one entry in apps. They apply only while Inspect has set the app's transaction variable, such as tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. Listing forgejo, a fork of gitea, brings gitea's fixes too. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5
36 lines
1.6 KiB
Plaintext
36 lines
1.6 KiB
Plaintext
# Forgejo's fixes: on Forgejo's paths, some fields skip the rules that refused
|
|
# ordinary Forgejo requests there. Forgejo is a fork of gitea. A hostname that
|
|
# gets Forgejo's fixes gets gitea's too, so this file holds only what Forgejo
|
|
# sends and gitea does not. Each exclusion runs with the request, before the
|
|
# rules it switches off, so this file is loaded before the Core Rule Set's
|
|
# rules. Each comment names a request the rule refused.
|
|
|
|
# Unless SWW_APPS lists forgejo for the request's hostname, every rule below is
|
|
# skipped. Inspect sets tx.app_forgejo when it does.
|
|
# The skip reaches only phase 1, so a rule of a later phase must check
|
|
# tx.app_forgejo itself.
|
|
SecRule &TX:app_forgejo "@eq 0" \
|
|
"id:900670,phase:1,pass,nolog,skipAfter:END_FORGEJO"
|
|
|
|
# Forgejo's search of a wiki sends the text searched for in q, which skips
|
|
# these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
|
|
"id:900680,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Forgejo's admin page searches the names of repositories in q on /admin/repos,
|
|
# which skips the list of command names (932260) there. It refused python3.
|
|
SecRule REQUEST_FILENAME "@streq /admin/repos" \
|
|
"id:900691,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
SecMarker END_FORGEJO
|