sneak
bdbd3e6ea9
check / check (push) Waiting to run
Each app's fixes are one .conf file and one entry in apps. They apply only while Inspect has set the app's transaction variable, such as tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. Listing forgejo, a fork of gitea, brings gitea's fixes too. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5
132 lines
5.8 KiB
Plaintext
132 lines
5.8 KiB
Plaintext
# Forgejo's fixes: on Forgejo's paths, some fields skip the rules that refused
|
|
# ordinary Forgejo requests there. Forgejo is a fork of gitea. A hostname that
|
|
# gets Forgejo's fixes gets gitea's too, so this file holds only what Forgejo
|
|
# sends and gitea does not. Each exclusion runs with the request, before the
|
|
# rules it switches off, so this file is loaded before the Core Rule Set's
|
|
# rules. Each comment names a request the rule refused.
|
|
|
|
# Unless SWW_APPS lists forgejo for the request's hostname, every rule below is
|
|
# skipped. Inspect sets tx.app_forgejo when it does.
|
|
# The skip reaches only phase 1, so a rule of a later phase must check
|
|
# tx.app_forgejo itself.
|
|
SecRule &TX:app_forgejo "@eq 0" \
|
|
"id:900670,phase:1,pass,nolog,skipAfter:END_FORGEJO"
|
|
|
|
# Forgejo's search of a wiki sends the text searched for in q, which skips
|
|
# these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
|
|
"id:900680,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Forgejo's search of a repository's code at a branch or a tag sends the text
|
|
# searched for in q. The search box on a repository's home page sends it there
|
|
# when Forgejo has no code indexer, as by default. A branch or tag name can
|
|
# hold a slash, as feat/docker-support does. q skips there the rules it skips
|
|
# on gitea's search of code (900600 in gitea.conf). Among them, these refused
|
|
# Forgejo's searches there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
# Forgejo has no owner named api, so a path under /api/ gets none of this.
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/search/(?:branch|tag)/.+$" \
|
|
"id:900681,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_FILENAME "!@rx ^/api/" \
|
|
"ctl:ruleRemoveTargetById=930110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=931100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932140;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932235;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932380;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=933135;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=934130;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=941390;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942140;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942190;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=942230;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944100;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944110;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=944130;ARGS:q"
|
|
|
|
# A page opened from the results of that search has the search's address in
|
|
# Referer, which skips these rules then, as after gitea's searches (900601 in
|
|
# gitea.conf):
|
|
# 941110: <script>
|
|
# 941120: onClick={
|
|
# 941160: <img src=
|
|
# 942100: LIKE '%foo%'
|
|
# 944100: java.lang.Runtime
|
|
# A path under /api/ is left out here too.
|
|
SecRule REQUEST_HEADERS:Referer \
|
|
"@rx ^https?://[^/]+/[^/]+/[^/]+/search/(?:branch|tag)/[^?]+\?" \
|
|
"id:900684,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/" \
|
|
"ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
|
|
ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
|
|
|
|
# Forgejo's search of a repository's releases, on its page and in the API,
|
|
# matches q against each release's title and tag. A tag name can hold a slash.
|
|
# q skips these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
# Forgejo has no owner named api, so /api/v1/releases is not one.
|
|
SecRule REQUEST_FILENAME "@rx ^/(?:api/v1/repos/)?[^/]+/[^/]+/releases$" \
|
|
"id:900682,phase:1,pass,nolog,chain"
|
|
SecRule REQUEST_FILENAME "!@rx ^/api/[^/]+/releases$" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# The API's search of a job's log sends the text searched for in q, which
|
|
# skips these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
SecRule REQUEST_FILENAME \
|
|
"@rx ^/api/v1/repos/[^/]+/[^/]+/actions/jobs/[0-9]+/logs$" \
|
|
"id:900683,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
# Forgejo's admin page searches the names of repositories in q on /admin/repos,
|
|
# which skips the list of command names (932260) there. It refused python3.
|
|
SecRule REQUEST_FILENAME "@streq /admin/repos" \
|
|
"id:900691,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:q"
|
|
|
|
SecMarker END_FORGEJO
|