sneak
4bceebfae2
check / check (push) Failing after 18m2s
Each app's fixes are one .conf file and one entry in apps. They apply only while Inspect has set the app's transaction variable, such as tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5
339 lines
15 KiB
Plaintext
339 lines
15 KiB
Plaintext
# gitea's fixes: some fields skip the rules that refused ordinary gitea requests.
|
|
# They are the fields where gitea sends a search, a file name or a branch name.
|
|
# Each exclusion runs with the request, before the rules it switches off, those
|
|
# of phase 1 included, so this file is loaded before the Core Rule Set's rules.
|
|
# Each comment names a request the rule refused.
|
|
|
|
# Unless SWW_APPS lists gitea for the request's hostname, every rule below is
|
|
# skipped. Inspect sets tx.app_gitea when it does.
|
|
# The skip reaches only phase 1, so a rule of a later phase must check
|
|
# tx.app_gitea itself.
|
|
SecRule &TX:app_gitea "@eq 0" \
|
|
"id:900590,phase:1,pass,nolog,skipAfter:END_GITEA"
|
|
|
|
# The query parameters in which gitea sends names within a repository or its
|
|
# own records, or a page of its own site, are not checked against the lists of
|
|
# system files, shell paths and command names, on any path:
|
|
# 930120: .gitignore
|
|
# 932160: bin/docker-entrypoint
|
|
# 932260: docker-build
|
|
SecAction "id:900591,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:files,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:skip-to,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:sub_path,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:ref,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:sha,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:branch,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:workflow,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:artifactName,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:files,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:skip-to,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:sub_path,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:ref,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:sha,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:branch,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:workflow,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:artifactName,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:files,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:skip-to,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:sub_path,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:ref,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:sha,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:branch,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:workflow,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:artifactName,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:redirect_to"
|
|
|
|
# gitea's searches of code, of issues and pull requests, and of commits send the
|
|
# text searched for in q, which skips these rules there:
|
|
# 930110: ../
|
|
# 930120: .gitignore
|
|
# 931100: http://127.0.0.1:8080
|
|
# 932120: Invoke-WebRequest
|
|
# 932130: $(pwd)
|
|
# 932140: if (a == b) {
|
|
# 932160: /bin/sh
|
|
# 932235: `make check`
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
# 932380: `whoami`
|
|
# 933100: <?php echo
|
|
# 933130: $_GET[
|
|
# 933135: ${VAR}
|
|
# 934100: process.env
|
|
# 934110: http://127.0.0.1:8080
|
|
# 934130: __proto__
|
|
# 941100: <script>
|
|
# 941110: <script>
|
|
# 941160: <img src=
|
|
# 941180: document.cookie
|
|
# 941390: fetch(
|
|
# 942100: SELECT * FROM users WHERE
|
|
# 942140: information_schema
|
|
# 942190: union select
|
|
# 942230: if (a == b) {
|
|
# 944100: java.lang.Runtime
|
|
# 944110: java.lang.Runtime
|
|
# 944130: java.lang.Runtime
|
|
# gitea has no owner named api. A repository's search, issues, pull requests and
|
|
# commit search with that owner get none of this. /api/v2/search, for example,
|
|
# is Mastodon's search.
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
|
|
[^/]+/-/code|\
|
|
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
|
|
commits/(?:branch|tag|commit)/.+/search)|\
|
|
api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))$" \
|
|
"id:900600,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/(?:search|issues(?:/search)?|\
|
|
pulls|commits/(?:branch|tag|commit)/.+/search)$" \
|
|
"ctl:ruleRemoveTargetById=930110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=931100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932140;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932235;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932380;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933135;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941390;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942190;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942230;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:q"
|
|
|
|
# A page opened from the results of one of those searches has the search's
|
|
# address in Referer, which skips these rules then:
|
|
# 941110: <script>
|
|
# 941120: onClick={
|
|
# 941160: <img src=
|
|
# 942100: LIKE '%foo%'
|
|
# 944100: java.lang.Runtime
|
|
# A repository with the owner api is left out here too.
|
|
SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
|
|
issues(?:/search)?|pulls|[^/]+/-/code|\
|
|
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
|
|
commits/(?:branch|tag|commit)/.+/search)|\
|
|
api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))\?" \
|
|
"id:900601,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/[^/]+/(?:search|\
|
|
issues(?:/search)?|pulls|commits/(?:branch|tag|commit)/.+/search)\?" \
|
|
"ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
|
|
|
|
# gitea's searches of repositories, users, branches, tags and packages send a
|
|
# name in q, which skips these rules there:
|
|
# 930120: .profile
|
|
# 932120: powershell-scripts
|
|
# 932260: python3-app
|
|
# 944130: org.apache.commons.logging
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
|
|
[^/]+/-/packages|[^/]+/[^/]+/(?:branches|tags)|api/v1/repos/search)$" \
|
|
"id:900602,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:q"
|
|
|
|
# gitea's other searches for a name send it in q too, which skips only these
|
|
# rules there:
|
|
# 930120: .profile
|
|
# 932120: powershell-scripts
|
|
# 932260: python3-app
|
|
# The searches:
|
|
# - the dashboard's filter of repositories;
|
|
# - the repositories on a user's or an organisation's page, whose path has
|
|
# one segment;
|
|
# - the author filter of the issue and pull request lists;
|
|
# - the lists of users and organisations, and the API's search for users.
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+|repo/search|\
|
|
explore/(?:users|organizations)|api/v1/users/search|\
|
|
[^/]+/[^/]+/(?:issues|pulls)/posters)$" \
|
|
"id:900603,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# These requests name a file in the path, which skips these rules there:
|
|
# 920500: notes.txt~
|
|
# 934100: process.env.d.ts
|
|
# 941130: docs/a b.xhtml
|
|
# 944130: java.lang.String.md
|
|
# The requests:
|
|
# - a file's page, raw file and download;
|
|
# - its blame, history, edit, preview and delete pages;
|
|
# - the API's call for its contents;
|
|
# - a release attachment's download.
|
|
SecRule REQUEST_FILENAME \
|
|
"@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_preview|_delete|contents|releases/download)/" \
|
|
"id:900610,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=920500;REQUEST_FILENAME,\
|
|
ctl:ruleRemoveTargetById=934100;REQUEST_FILENAME,\
|
|
ctl:ruleRemoveTargetById=941130;REQUEST_FILENAME,\
|
|
ctl:ruleRemoveTargetById=944130;REQUEST_FILENAME"
|
|
|
|
# The requests below name a file in a query parameter. These rules refused
|
|
# them for the file named:
|
|
# 930120: .gitignore
|
|
# 932120: install-script.sh
|
|
# 932130: [draft].md
|
|
# 932160: bin/docker-entrypoint
|
|
# 932260: docker-compose.yml
|
|
# 934100: process.env.d.ts
|
|
# 934130: __proto__.json
|
|
# 941130: index.xhtml
|
|
# 941180: document.write.js
|
|
# 942140: information_schema.sql
|
|
# 944110: java/lang/Runtime.java
|
|
# 944130: java.lang.String.md
|
|
# Each request skips the rules that refused it. Rule 900591 already has path and
|
|
# redirect_to skip 930120, 932160 and 932260 on every path.
|
|
|
|
# A file's commit graph, in file.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/graph$" \
|
|
"id:900620,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:file,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:file"
|
|
|
|
# The API's list of a file's commits, in path.
|
|
SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/commits$" \
|
|
"id:900621,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:path"
|
|
|
|
# The API's call for the contents of several files, in body, as JSON.
|
|
SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/file-contents$" \
|
|
"id:900622,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:body,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:body"
|
|
|
|
# An issue opened from a template, in template.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/issues/new$" \
|
|
"id:900623,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=932130;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:template,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:template"
|
|
|
|
# The sign-in page on the way to a file's edit page, in redirect_to.
|
|
SecRule REQUEST_FILENAME "@rx ^/user/login$" \
|
|
"id:900624,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=932130;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:redirect_to,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:redirect_to"
|
|
|
|
# An attachment uploaded through the API to a release, an issue or a comment,
|
|
# in name.
|
|
SecRule REQUEST_FILENAME \
|
|
"@rx ^/api/v1/repos/[^/]+/[^/]+/(?:releases|issues|issues/comments)/[0-9]+/assets$" \
|
|
"id:900625,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:name,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:name"
|
|
|
|
# A diff's hidden lines, fetched when shown, in path.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/blob_excerpt/[0-9a-f]+$" \
|
|
"id:900626,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=941130;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:path,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:path"
|
|
|
|
# The requests below name a branch or tag in a query parameter, which skips
|
|
# the list of command names (932260) there. It refused names such as
|
|
# docker-build, python3-migration and feat/docker-support.
|
|
|
|
# Deleting or restoring a branch, in name.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/branches/(?:delete|restore)$" \
|
|
"id:900630,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:name"
|
|
|
|
# A release started from a tag, in tag.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/releases/new$" \
|
|
"id:900631,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:tag"
|
|
|
|
# A branch protection rule opened for editing, in rule_name.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/branches/edit$" \
|
|
"id:900632,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:rule_name"
|
|
|
|
# A directory listing's last commits, in refSubUrl.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/lastcommit/" \
|
|
"id:900633,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:refSubUrl"
|
|
|
|
# An artifact upload from actions/upload-artifact@v3 sends the header
|
|
# Content-Range, which the Core Rule Set refused (920450).
|
|
SecRule REQUEST_FILENAME \
|
|
"@rx ^/api/actions_pipeline/_apis/pipelines/workflows/[0-9]+/artifacts/[^/]+/upload$" \
|
|
"id:900640,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=920450;REQUEST_HEADERS_NAMES:Content-Range"
|
|
|
|
SecMarker END_GITEA
|