demus/gitea-proxy-rule-exclusions-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 10 Activity

Allow giant blob uploads

Browse Source 
Fx. docker push
This commit is contained in:
demus
2025-01-24 01:17:02 +01:00
parent a458e07f5c
commit c0a9f061c4
2 changed files with 31 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/gitea-proxy-rule-exclusions-before.conf
+30 -7
View File
@@ -20,7 +20,7 @@ SecRule TX:gitea-proxy-rule-exclusions-plugin_enabled "@eq 0" \
phase:1,\
pass,\
nolog,\
ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
ver:'gitea-proxy-rule-exclusions-plugin/1.4.0',\
ctl:ruleRemoveById=92002-92999"
#
@@ -36,7 +36,7 @@ SecRule &TX:allowed_request_content_type "@eq 0" \
phase:1,\
pass,\
nolog,\
ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
ver:'gitea-proxy-rule-exclusions-plugin/1.4.0',\
setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json| |application/proto|'"
# Modify CRS rule 901164
@@ -45,20 +45,43 @@ SecRule &TX:restricted_extensions "@eq 0" \
phase:1,\
pass,\
nolog,\
ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
ver:'gitea-proxy-rule-exclusions-plugin/1.4.0',\
setvar:'tx.restricted_extensions=.backup/ .bak/ .cdx/ .cer/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .key/ .printer/ .rdb/ .swp/ .sys/'"
# Modify CRS rule 901165. git-upload-pack has it's own content-type and uses the content-encoding header
# Copy of CRS rule 901160.
SecRule &TX:allowed_methods "@eq 0" \
"id:92904,\
phase:1,\
pass,\
nolog,\
ver:'gitea-proxy-rule-exclusions-plugin/1.4.0',\
setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"
# Modify CRS rule 901165 and 920420. git-upload-pack has it's own content-type and uses the content-encoding header
SecRule REQUEST_URI "@endsWith git-upload-pack" \
"id:92010,\
phase:1,\
pass,\
t:none,\
ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
ver:'gitea-proxy-rule-exclusions-plugin/1.4.0',\
nolog,\
setvar:'tx.allowed_request_content_type=%{TX.allowed_request_content_type} |application/x-git-upload-pack-request|',\
setvar:'tx.restricted_headers_basic=/proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/'"
# Modify CRS rule 911100 and 920420. docker push uploads blobs
SecRule REQUEST_URI "@beginsWith /v2" \
"id:92011,\
phase:1,\
chain,\
pass,\
t:none,\
ver:'gitea-proxy-rule-exclusions-plugin/1.4.0',\
nolog,\
setvar:'tx.allowed_request_content_type=%{TX.allowed_request_content_type} |application/octet-stream| |application/vnd.docker.distribution.manifest.v2+json|',\
setvar:'tx.allowed_methods=%{tx.allowed_methods} PUT PATCH',\
ctl:requestBodyLimit=1073741824"
SecRule REQUEST_URI "@strmatch /blobs/uploads/" "t:none"
# Provide a way to whitelist filenames that are in restricted-files.data
SecRule REQUEST_FILENAME "@pmFromFile gitea-proxy-whitelisted-files.data" \
"id:92020,\
@@ -66,7 +89,7 @@ SecRule REQUEST_FILENAME "@pmFromFile gitea-proxy-whitelisted-files.data" \
pass,\
nolog,\
t:none,\
ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
ver:'gitea-proxy-rule-exclusions-plugin/1.4.0',\
ctl:ruleRemoveById=930130"
# Gitea is written in Go, so disable PHP-related rules, as a PHP git project would cause false positives
@@ -76,5 +99,5 @@ SecAction \
pass,\
nolog,\
t:none,\
ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
ver:'gitea-proxy-rule-exclusions-plugin/1.4.0',\
ctl:ruleRemoveByTag=language-php"
plugins/gitea-proxy-rule-exclusions-config.conf
+1 -1
View File
@@ -38,5 +38,5 @@
# phase:1,\
# pass,\
# nolog,\
# ver:'gitea-proxy-rule-exclusions-plugin/1.1.0',\
# ver:'gitea-proxy-rule-exclusions-plugin/1.4.0',\
# setvar:'tx.gitea-proxy-rule-exclusions-plugin_enabled=0'"