sneak
b7e1b6d501
check / check (push) Waiting to run
Each app's fixes are one .conf file and one entry in apps. They apply only while Inspect has set the app's transaction variable, such as tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5
228 lines
18 KiB
Plaintext
228 lines
18 KiB
Plaintext
# Mastodon's fixes: on Mastodon's paths, some fields skip the rules that
|
|
# refused ordinary Mastodon requests there. They are the fields where Mastodon
|
|
# sends a search, a name, a title, a file name, an address or free text. Each
|
|
# exclusion runs with the request, before the rules it switches off, so this
|
|
# file is loaded before the Core Rule Set's rules. Each comment names a request
|
|
# a rule refused. An exclusion on a field of a body applies only when the query
|
|
# has no parameter of that name, so it matters only while SWW_WAF_BODY_LIMIT is
|
|
# set.
|
|
#
|
|
# Gitea serves /api/v1/ too, and Drupal serves /admin/. So only Mastodon's own
|
|
# resources under them count as Mastodon's paths.
|
|
#
|
|
# Four rules read a search, a name or free text as a command or a system file.
|
|
# Each exclusion below for such a field removes these four, and only these:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
|
|
# Unless SWW_APPS lists mastodon for the request's hostname, every rule below is
|
|
# skipped. Inspect sets tx.app_mastodon when it does.
|
|
# The skip reaches only phase 1, so a rule of a later phase must check
|
|
# tx.app_mastodon itself.
|
|
SecRule &TX:app_mastodon "@eq 0" \
|
|
"id:900940,phase:1,pass,nolog,skipAfter:END_MASTODON"
|
|
|
|
# The API's searches and names, in the query:
|
|
# q: /api/v2/search?q=python3, /api/v1/accounts/search?q=ls+-la
|
|
# acct: /api/v1/accounts/lookup?acct=python3
|
|
# username, display_name, email, by_domain: the admin API's search of
|
|
# accounts, /api/v1/admin/accounts?username=python3&display_name=powershell
|
|
SecRule REQUEST_FILENAME "@rx ^/api/v[12]/(?:search|accounts|admin/accounts)(?:/|$)" \
|
|
"id:900950,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:q|acct|username|display_name|email|by_domain)$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:q|acct|username|display_name|email|by_domain)$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:q|acct|username|display_name|email|by_domain)$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:q|acct|username|display_name|email|by_domain)$/"
|
|
|
|
# The API's titles, names and free text, in form data or JSON bodies:
|
|
# spoiler_text, poll[options][]: posting, spoiler_text=python3+details
|
|
# description: describing an uploaded file, description=Screenshot+of+ls+-la
|
|
# display_name, note, fields_attributes[0][name], fields_attributes[0][value]:
|
|
# editing a profile, note=python3+and+powershell
|
|
# title: naming a list or a filter, title=python3+friends
|
|
# keyword, keywords_attributes[][keyword]: a filter's words, keyword=powershell
|
|
# name: featuring a hashtag, name=python3
|
|
# comment: a report, a note on an account or an IP block, comment=Knows+python3
|
|
# text: warning an account, text=Please+stop+posting+powershell+malware
|
|
# private_comment, public_comment: blocking a domain
|
|
# The web app sends these in JSON:
|
|
# spoiler_text, title and the poll's options
|
|
# description, and media_attributes[].description when it edits a post
|
|
# display_name, note and fields_attributes[].name and .value, on
|
|
# /api/v1/profile, {"note":"ls -la shows the .htaccess file"}
|
|
# comment, on a report or a note on an account
|
|
SecRule REQUEST_FILENAME "@rx ^/api/v[12]/(?:statuses|media|accounts|profile|lists|filters|featured_tags|reports|admin/(?:accounts|domain_blocks|ip_blocks))(?:/|$)" \
|
|
"id:900951,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^(?:spoiler_text|poll\[options\]\[\]|description|display_name|note|fields_attributes\[\d+\]\[(?:name|value)\]|title|keyword|keywords_attributes\[\d*\]\[keyword\]|name|comment|text|private_comment|public_comment|json\.(?:spoiler_text|title|poll\.options\.\d+|description|media_attributes\.\d+\.description|display_name|note|fields_attributes\.\d+\.(?:name|value)|comment))$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:spoiler_text|poll\[options\]\[\]|description|display_name|note|fields_attributes\[\d+\]\[(?:name|value)\]|title|keyword|keywords_attributes\[\d*\]\[keyword\]|name|comment|text|private_comment|public_comment|json\.(?:spoiler_text|title|poll\.options\.\d+|description|media_attributes\.\d+\.description|display_name|note|fields_attributes\.\d+\.(?:name|value)|comment))$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:spoiler_text|poll\[options\]\[\]|description|display_name|note|fields_attributes\[\d+\]\[(?:name|value)\]|title|keyword|keywords_attributes\[\d*\]\[keyword\]|name|comment|text|private_comment|public_comment|json\.(?:spoiler_text|title|poll\.options\.\d+|description|media_attributes\.\d+\.description|display_name|note|fields_attributes\.\d+\.(?:name|value)|comment))$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:spoiler_text|poll\[options\]\[\]|description|display_name|note|fields_attributes\[\d+\]\[(?:name|value)\]|title|keyword|keywords_attributes\[\d*\]\[keyword\]|name|comment|text|private_comment|public_comment|json\.(?:spoiler_text|title|poll\.options\.\d+|description|media_attributes\.\d+\.description|display_name|note|fields_attributes\.\d+\.(?:name|value)|comment))$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:spoiler_text|poll\[options\]\[\]|description|display_name|note|fields_attributes\[\d+\]\[(?:name|value)\]|title|keyword|keywords_attributes\[\d*\]\[keyword\]|name|comment|text|private_comment|public_comment|json\.(?:spoiler_text|title|poll\.options\.\d+|description|media_attributes\.\d+\.description|display_name|note|fields_attributes\.\d+\.(?:name|value)|comment))$/"
|
|
|
|
# A post's text, in status, form data from an app or JSON from the web app.
|
|
# Each of these rules refused posting "Today I learned: `ls -la ~/.config`
|
|
# lists hidden files, and `python3 -m http.server` serves a folder", so they
|
|
# skip status: the four rules, 932125, 932230 and 932235.
|
|
SecRule REQUEST_FILENAME "@rx ^/api/v1/statuses(?:/|$)" \
|
|
"id:900952,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^(?:json\.)?status$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:json\.)?status$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:json\.)?status$/,\
|
|
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:json\.)?status$/,\
|
|
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:json\.)?status$/,\
|
|
ctl:ruleRemoveTargetById=932235;ARGS:/^(?:json\.)?status$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?status$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?status$/"
|
|
|
|
# Uploaded files' names skip 932180, which refused uploading
|
|
# "Example .htaccess.png" as a server's own file, for a post or as a profile's
|
|
# picture. Coraza keeps these names without the field each came in. Mastodon
|
|
# refuses a file of a type it does not allow.
|
|
SecRule REQUEST_FILENAME "@rx ^/api/v[12]/media$|^/api/v1/accounts/update_credentials$|^/api/v1/profile$" \
|
|
"id:900953,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=932180;FILES"
|
|
|
|
# The admin pages' searches, in the query:
|
|
# username, display_name, email: /admin/accounts?username=python3
|
|
# by_domain: /admin/instances?by_domain=python3
|
|
# shortcode: /admin/custom_emojis?shortcode=python3
|
|
# name: /admin/tags?name=python3
|
|
SecRule REQUEST_FILENAME "@rx ^/admin/(?:accounts|instances|custom_emojis|tags)$" \
|
|
"id:900954,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:username|display_name|email|by_domain|shortcode|name)$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:username|display_name|email|by_domain|shortcode|name)$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:username|display_name|email|by_domain|shortcode|name)$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:username|display_name|email|by_domain|shortcode|name)$/"
|
|
|
|
# The admin pages' free text, in bodies:
|
|
# domain_block[private_comment], domain_block[public_comment]: blocking a
|
|
# domain, "Spam about powershell and .htaccess"
|
|
# ip_block[comment]: blocking an address
|
|
# rule[text], rule[hint]: a server rule, "No posting of powershell malware"
|
|
# announcement[text]: an announcement
|
|
# form_admin_settings[site_title], [site_short_description],
|
|
# [site_extended_description]: the server's name and descriptions,
|
|
# "Python3 social"
|
|
# admin_account_action[text]: warning an account, on
|
|
# /admin/accounts/<id>/action
|
|
# report_note[content], account_moderation_note[content]: a moderator's
|
|
# note on a report or an account, "ls -la shows the .htaccess file"
|
|
# account_warning_preset[title], [text]: a preset warning
|
|
# user_role[name]: a role
|
|
# terms_of_service[text], [changelog]: the terms of service
|
|
SecRule REQUEST_FILENAME "@rx ^/admin/(?:domain_blocks|ip_blocks|rules|announcements|settings|accounts/[^/]+/action|report_notes|account_moderation_notes|warning_presets|roles|terms_of_service)(?:/|$)" \
|
|
"id:900955,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^(?:domain_block\[(?:private|public)_comment\]|ip_block\[comment\]|rule\[(?:text|hint)\]|announcement\[text\]|form_admin_settings\[site_(?:title|short_description|extended_description)\]|admin_account_action\[text\]|(?:report_note|account_moderation_note)\[content\]|account_warning_preset\[(?:title|text)\]|user_role\[name\]|terms_of_service\[(?:text|changelog)\])$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:domain_block\[(?:private|public)_comment\]|ip_block\[comment\]|rule\[(?:text|hint)\]|announcement\[text\]|form_admin_settings\[site_(?:title|short_description|extended_description)\]|admin_account_action\[text\]|(?:report_note|account_moderation_note)\[content\]|account_warning_preset\[(?:title|text)\]|user_role\[name\]|terms_of_service\[(?:text|changelog)\])$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:domain_block\[(?:private|public)_comment\]|ip_block\[comment\]|rule\[(?:text|hint)\]|announcement\[text\]|form_admin_settings\[site_(?:title|short_description|extended_description)\]|admin_account_action\[text\]|(?:report_note|account_moderation_note)\[content\]|account_warning_preset\[(?:title|text)\]|user_role\[name\]|terms_of_service\[(?:text|changelog)\])$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:domain_block\[(?:private|public)_comment\]|ip_block\[comment\]|rule\[(?:text|hint)\]|announcement\[text\]|form_admin_settings\[site_(?:title|short_description|extended_description)\]|admin_account_action\[text\]|(?:report_note|account_moderation_note)\[content\]|account_warning_preset\[(?:title|text)\]|user_role\[name\]|terms_of_service\[(?:text|changelog)\])$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:domain_block\[(?:private|public)_comment\]|ip_block\[comment\]|rule\[(?:text|hint)\]|announcement\[text\]|form_admin_settings\[site_(?:title|short_description|extended_description)\]|admin_account_action\[text\]|(?:report_note|account_moderation_note)\[content\]|account_warning_preset\[(?:title|text)\]|user_role\[name\]|terms_of_service\[(?:text|changelog)\])$/"
|
|
|
|
# The settings pages' names, words and addresses, and passwords, in bodies:
|
|
# custom_filter[title], custom_filter[keywords_attributes][0][keyword]: a
|
|
# filter, "python3 spam" and "ls -la"
|
|
# doorkeeper_application[name], doorkeeper_application[website]: an
|
|
# application, "https://example.org/powershell"
|
|
# account_alias[acct], account_migration[acct]: moving an account
|
|
# user[password], user[password_confirmation], user[current_password]:
|
|
# signing in, signing up and changing the password
|
|
# user[invite_request_attributes][text]: why someone signs up, while sign-ups
|
|
# need approval
|
|
# account_migration[current_password], form_redirect[current_password],
|
|
# form_delete_confirmation[password]: moving or deleting an account
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:filters|settings/(?:applications|aliases|migration|delete)|auth)(?:/|$)" \
|
|
"id:900956,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^(?:custom_filter\[(?:title|keywords_attributes\]\[\d+\]\[keyword)\]|doorkeeper_application\[(?:name|website)\]|account_(?:alias|migration)\[acct\]|user\[(?:password|password_confirmation|current_password)\]|user\[invite_request_attributes\]\[text\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:custom_filter\[(?:title|keywords_attributes\]\[\d+\]\[keyword)\]|doorkeeper_application\[(?:name|website)\]|account_(?:alias|migration)\[acct\]|user\[(?:password|password_confirmation|current_password)\]|user\[invite_request_attributes\]\[text\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:custom_filter\[(?:title|keywords_attributes\]\[\d+\]\[keyword)\]|doorkeeper_application\[(?:name|website)\]|account_(?:alias|migration)\[acct\]|user\[(?:password|password_confirmation|current_password)\]|user\[invite_request_attributes\]\[text\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:custom_filter\[(?:title|keywords_attributes\]\[\d+\]\[keyword)\]|doorkeeper_application\[(?:name|website)\]|account_(?:alias|migration)\[acct\]|user\[(?:password|password_confirmation|current_password)\]|user\[invite_request_attributes\]\[text\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:custom_filter\[(?:title|keywords_attributes\]\[\d+\]\[keyword)\]|doorkeeper_application\[(?:name|website)\]|account_(?:alias|migration)\[acct\]|user\[(?:password|password_confirmation|current_password)\]|user\[invite_request_attributes\]\[text\]|(?:account_migration|form_redirect)\[current_password\]|form_delete_confirmation\[password\])$/"
|
|
|
|
# The web app's search page: /search?q=python3.
|
|
SecRule REQUEST_FILENAME "@streq /search" \
|
|
"id:900957,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Deliveries from other servers to an inbox, in JSON. The fields of the object
|
|
# delivered skip the four rules:
|
|
# content, contentMap: a post, "<p>notes on python3, powershell, ...</p>"
|
|
# summary, summaryMap: a post's content warning, or a profile's text
|
|
# name: a profile's name, "Alice powershell"
|
|
# attachment: a picture's description, or a profile's fields
|
|
# oneOf, anyOf: a poll's options, "python3"
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:inbox|users/[^/]+/inbox|ap/users/[0-9]+/inbox)$" \
|
|
"id:900958,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.object\./ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.object\.(?:content|contentmap\.[^.]+|summary|summarymap\.[^.]+|name|attachment\.\d+\.(?:name|value)|(?:oneof|anyof)\.\d+\.name)$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.object\.(?:content|contentmap\.[^.]+|summary|summarymap\.[^.]+|name|attachment\.\d+\.(?:name|value)|(?:oneof|anyof)\.\d+\.name)$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.object\.(?:content|contentmap\.[^.]+|summary|summarymap\.[^.]+|name|attachment\.\d+\.(?:name|value)|(?:oneof|anyof)\.\d+\.name)$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.object\.(?:content|contentmap\.[^.]+|summary|summarymap\.[^.]+|name|attachment\.\d+\.(?:name|value)|(?:oneof|anyof)\.\d+\.name)$/"
|
|
|
|
# When someone on another server looks up a link to a profile or a post here,
|
|
# such as /@admin or /@admin/117589811962372311, that server fetches the link
|
|
# with this header. It sends it again to the account or post the link leads to.
|
|
# 920600 refused it as a malformed Accept header:
|
|
# Accept: application/ld+json; profile="https://www.w3.org/ns/activitystreams",
|
|
# application/activity+json, text/html;q=0.1
|
|
SecRule REQUEST_FILENAME "@rx ^/@[^/]+(?:/[0-9]+)?$|^/(?:ap/)?users/|^/actor$" \
|
|
"id:900959,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=920600;REQUEST_HEADERS:Accept"
|
|
|
|
# Signing up through the API, in form data or JSON:
|
|
# password, reason: password=ls+-la+shows+the+.htaccess+file
|
|
SecRule REQUEST_FILENAME "@streq /api/v1/accounts" \
|
|
"id:900960,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^(?:json\.)?(?:password|reason)$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:json\.)?(?:password|reason)$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:json\.)?(?:password|reason)$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?(?:password|reason)$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?(?:password|reason)$/"
|
|
|
|
# The web app's reports have the JSON keys forward and forward_to_domains. A
|
|
# report forwarded to another server lists that server in forward_to_domains.
|
|
# Their names contain .forward, a file in a home folder, so 930120 refused every
|
|
# report the web app sent. The names are:
|
|
# json.forward
|
|
# json.forward_to_domains
|
|
# json.forward_to_domains.0, json.forward_to_domains.1 and so on, one per
|
|
# server, such as remote.example
|
|
SecRule REQUEST_FILENAME "@streq /api/v1/reports" \
|
|
"id:900961,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.forward/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS_NAMES:/^json\.forward(?:_to_domains(?:\.\d+)?)?$/"
|
|
|
|
# A hashtag and a username hold only letters, digits and underscores. So the
|
|
# web app's featured hashtags and the sign-up form's username skip only 932120
|
|
# and 932260, which refused the hashtag or username python3 or powershell.
|
|
SecRule REQUEST_FILENAME "@streq /api/v1/featured_tags" \
|
|
"id:900962,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.name$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=932120;ARGS:/^json\.name$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.name$/"
|
|
SecRule REQUEST_FILENAME "@streq /auth" \
|
|
"id:900963,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^user\[account_attributes\]\[username\]$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=932120;ARGS:/^user\[account_attributes\]\[username\]$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^user\[account_attributes\]\[username\]$/"
|
|
|
|
# The sign-up, sign-in, password reset and account settings forms send an
|
|
# email address in user[email]. It skips 930120, 932120 and 932260, which
|
|
# refused these addresses:
|
|
# 930120: jane.profile@example.com
|
|
# 932120: powershell@example.com
|
|
# 932260: python3@example.com
|
|
# An address holds no spaces, so it keeps 932250, which needs ls -la.
|
|
SecRule REQUEST_FILENAME "@rx ^/auth(?:/|$)" \
|
|
"id:900964,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^user\[email\]$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^user\[email\]$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^user\[email\]$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^user\[email\]$/"
|
|
|
|
SecMarker END_MASTODON
|