clawbot
5ef701a381
check / check (push) Waiting to run
While SWW_WAF_BODY_LIMIT is set, these body fields skip only the rules that refused them, on their own paths: - the web editor's tree_path, commit_summary and content; - new_branch_name of a branch created on the web or the API; - from and to of a renamed branch, on gitea's and Forgejo's paths; - head of a pull request and message of a file, through the API. None applies when the query has a parameter of the same name. The requests were recorded from gitea 1.27.3 and Forgejo 17.0.1. Model: opus-5-5
33 lines
1.5 KiB
Plaintext
33 lines
1.5 KiB
Plaintext
# The fifteenth change: on Forgejo's paths, some fields skip the rules that
|
|
# refused ordinary Forgejo requests there. Forgejo is a fork of gitea, and the
|
|
# eighth change's fixes for gitea apply to its requests too, so this file holds
|
|
# only what Forgejo sends and gitea does not. Each exclusion runs with the
|
|
# request, before the rules it switches off, so this file is loaded before the
|
|
# Core Rule Set's rules. Each comment names a request the rule refused.
|
|
|
|
# Forgejo's search of a wiki sends the text searched for in q, which skips
|
|
# these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
|
|
"id:900680,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Forgejo renames a branch on its own path, where from and to name branches.
|
|
# They skip the list of command names (932260), which refused
|
|
# feat/docker-support and feat/python3-support. They are read only while
|
|
# SWW_WAF_BODY_LIMIT is set, and skip nothing when the query has a parameter of
|
|
# the same name.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/rename_branch$" \
|
|
"id:900666,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=932260;ARGS:from,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:to"
|