clawbot
7e26fe37bc
check / check (push) Successful in 3m20s
The Gitea setup runs the Core Rule Set in block mode. Rules that refused ordinary Gitea requests are switched off only where they misfired: - deploy/gitea/crs-exclusions.conf, loaded through the new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE, covers Gitea's search, file-name and branch-name fields, Referer, and file paths; - smallwebwaf's defaults gain a seventh change: the registry upload path's from parameter skips 932260. A file that cannot be read, does not parse or names an id from 900000 to 900999 stops servewaf at start. internal/waf's tests and script/gitea-setup send the recorded requests in internal/waf/testdata/gitea-requests.txt and three attacks. Model: opus-5-5
97 lines
5.1 KiB
Plaintext
97 lines
5.1 KiB
Plaintext
# The Core Rule Set's exclusions for Gitea, which servewaf loads from
|
|
# SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE. Each switches one rule off for the
|
|
# Gitea fields or paths where it refused ordinary Gitea requests. Gitea
|
|
# sends these in the query string:
|
|
# - q: the text of every search;
|
|
# - file, path, template, body and redirect_to: a file name, alone or in
|
|
# JSON or a link;
|
|
# - name, tag, rule_name and refSubUrl: a branch or tag name.
|
|
# docs/gitea.md says how to add an exclusion.
|
|
|
|
# Searches.
|
|
# 930110: a search for ../
|
|
SecRuleUpdateTargetById 930110 "!ARGS:q"
|
|
# 931100: a search for http://127.0.0.1:8080
|
|
SecRuleUpdateTargetById 931100 "!ARGS:q"
|
|
# 932140: a search for if (a == b) {
|
|
SecRuleUpdateTargetById 932140 "!ARGS:q"
|
|
# 932235: a search for `make check`
|
|
SecRuleUpdateTargetById 932235 "!ARGS:q"
|
|
# 932250: a search for ls -la
|
|
SecRuleUpdateTargetById 932250 "!ARGS:q"
|
|
# 932380: a search for `whoami`
|
|
SecRuleUpdateTargetById 932380 "!ARGS:q"
|
|
# 933135: a search for ${VAR}
|
|
SecRuleUpdateTargetById 933135 "!ARGS:q"
|
|
# 934110: a search for http://127.0.0.1:8080
|
|
SecRuleUpdateTargetById 934110 "!ARGS:q"
|
|
# 941100: a search for <script>
|
|
SecRuleUpdateTargetById 941100 "!ARGS:q"
|
|
# 941110: a search for <script>, or a page opened from its results
|
|
SecRuleUpdateTargetById 941110 "!ARGS:q|!REQUEST_HEADERS:Referer"
|
|
# 941160: a search for <img src=, or a page opened from its results
|
|
SecRuleUpdateTargetById 941160 "!ARGS:q|!REQUEST_HEADERS:Referer"
|
|
# 941390: a search for fetch(
|
|
SecRuleUpdateTargetById 941390 "!ARGS:q"
|
|
# 942100: a search for SELECT * FROM users WHERE
|
|
SecRuleUpdateTargetById 942100 "!ARGS:q"
|
|
# 942190: a search for union select
|
|
SecRuleUpdateTargetById 942190 "!ARGS:q"
|
|
# 942230: a search for if (a == b) {
|
|
SecRuleUpdateTargetById 942230 "!ARGS:q"
|
|
# 944100: a search for java.lang.Runtime, or a page opened from its results
|
|
SecRuleUpdateTargetById 944100 "!ARGS:q|!REQUEST_HEADERS:Referer"
|
|
|
|
# Searches, and file, branch and tag names.
|
|
# 930120: a search for package.json, or the commit graph of .gitignore
|
|
SecRuleUpdateTargetById 930120 "!ARGS:q|!ARGS:file|!ARGS:template|!ARGS:body|\
|
|
!ARGS:refSubUrl|!ARGS:name|!ARGS:tag|!ARGS:rule_name"
|
|
# 932160: a search for /bin/sh, or the API's contents of bin/docker-entrypoint
|
|
SecRuleUpdateTargetById 932160 "!ARGS:q|!ARGS:file|!ARGS:template|!ARGS:body|\
|
|
!ARGS:refSubUrl|!ARGS:name|!ARGS:tag|!ARGS:rule_name"
|
|
# 932260: a search for python3, or deleting the branch docker-build
|
|
SecRuleUpdateTargetById 932260 "!ARGS:q|!ARGS:file|!ARGS:template|!ARGS:body|\
|
|
!ARGS:refSubUrl|!ARGS:name|!ARGS:tag|!ARGS:rule_name"
|
|
|
|
# Searches, and file names in the query string.
|
|
# 932120: a search for Invoke-WebRequest, or the commits of install-script.sh
|
|
SecRuleUpdateTargetById 932120 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
|
|
!ARGS:body|!ARGS:redirect_to"
|
|
# 932130: a search for $(pwd), or an issue opened from the template [draft].md
|
|
SecRuleUpdateTargetById 932130 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
|
|
!ARGS:body|!ARGS:redirect_to"
|
|
# 934100: a search for process.env, or the commits of process.env.d.ts
|
|
SecRuleUpdateTargetById 934100 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
|
|
!ARGS:body|!ARGS:redirect_to"
|
|
# 934130: a search for __proto__, or the commits of __proto__.json
|
|
SecRuleUpdateTargetById 934130 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
|
|
!ARGS:body|!ARGS:redirect_to"
|
|
# 941130: the commits of index.xhtml
|
|
SecRuleUpdateTargetById 941130 "!ARGS:file|!ARGS:path|!ARGS:template|\
|
|
!ARGS:body|!ARGS:redirect_to"
|
|
# 941180: a search for document.cookie, or the commits of document.write.js
|
|
SecRuleUpdateTargetById 941180 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
|
|
!ARGS:body|!ARGS:redirect_to"
|
|
# 942140: the commits of information_schema.sql
|
|
SecRuleUpdateTargetById 942140 "!ARGS:file|!ARGS:path|!ARGS:template|\
|
|
!ARGS:body|!ARGS:redirect_to"
|
|
# 944110: a search for java.lang.Runtime, or the commits of Runtime.java
|
|
SecRuleUpdateTargetById 944110 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
|
|
!ARGS:body|!ARGS:redirect_to"
|
|
# 944130: a search for java.lang.Runtime, the commits of java.lang.String.md,
|
|
# or any page opened from that file's page, which names it in the Referer
|
|
SecRuleUpdateTargetById 944130 "!ARGS:q|!ARGS:file|!ARGS:path|!ARGS:template|\
|
|
!ARGS:body|!ARGS:redirect_to|!REQUEST_HEADERS:Referer"
|
|
|
|
# File names in the path of a file's page, raw file, blame, history and edit
|
|
# page, and of the API's calls for its contents.
|
|
# 934100: the page of process.env.d.ts
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_delete|contents)/" \
|
|
"id:10001,phase:1,pass,nolog,ctl:ruleRemoveTargetById=934100;REQUEST_FILENAME"
|
|
# 941130: the page of docs/a b.xhtml
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_delete|contents)/" \
|
|
"id:10002,phase:1,pass,nolog,ctl:ruleRemoveTargetById=941130;REQUEST_FILENAME"
|
|
# 944130: the page of java.lang.String.md
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/(?:src|raw|media|blame|commits|_edit|_delete|contents)/" \
|
|
"id:10003,phase:1,pass,nolog,ctl:ruleRemoveTargetById=944130;REQUEST_FILENAME"
|