sneak
64497b32cd
check / check (push) Waiting to run
Forgejo 17.0.1's recorded requests are in testdata/forgejo-requests.txt, checked at the defaults. What Forgejo sends and gitea does not: - its flash cookie is named flash, which joins gitea_flash among the cookies left out; - its wiki search, whose q skips five rules in forgejo.conf, the fifteenth change. Gaps in gitea's fixes the recording showed: q on the name searches skips 932250 (ls -la), and the API's package search is one of them. User and organisation pages, any one-segment path, keep 932250. Model: opus-5-5
22 lines
982 B
Plaintext
22 lines
982 B
Plaintext
# The fifteenth change: on Forgejo's paths, some fields skip the rules that
|
|
# refused ordinary Forgejo requests there. Forgejo is a fork of gitea, and the
|
|
# eighth change's fixes for gitea apply to its requests too, so this file holds
|
|
# only what Forgejo sends and gitea does not. Each exclusion runs with the
|
|
# request, before the rules it switches off, so this file is loaded before the
|
|
# Core Rule Set's rules. Each comment names a request the rule refused.
|
|
|
|
# Forgejo's search of a wiki sends the text searched for in q, which skips
|
|
# these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
|
|
"id:900680,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|