demus/gitea-proxy-rule-exclusions-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Disable PHP rules. Gitea is written in Go

Browse Source
This commit is contained in:
Daniel Demus 2024-12-25 23:54:48 +01:00
parent 5f2c71c611
commit c567be56ba
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
plugins/gitea-proxy-rule-exclusions-before.conf
View File

@ -20,7 +20,7 @@ SecRule TX:gitea-proxy-rule-exclusions-plugin_enabled "@eq 0" \
phase:1,\ phase:1,\
pass,\ pass,\
nolog,\ nolog,\
ver:'gitea-proxy-rule-exclusions-plugin/1.1.0',\ ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
ctl:ruleRemoveById=92002-92999" ctl:ruleRemoveById=92002-92999"
# #
@ -36,7 +36,7 @@ SecRule &TX:allowed_request_content_type "@eq 0" \
phase:1,\ phase:1,\
pass,\ pass,\
nolog,\ nolog,\
ver:'gitea-proxy-rule-exclusions-plugin/1.1.0',\ ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json|'" setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json|'"
# Modify CRS rule 901164 # Modify CRS rule 901164
@ -45,7 +45,7 @@ SecRule &TX:restricted_extensions "@eq 0" \
phase:1,\ phase:1,\
pass,\ pass,\
nolog,\ nolog,\
ver:'gitea-proxy-rule-exclusions-plugin/1.1.0',\ ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
setvar:'tx.restricted_extensions=.backup/ .bak/ .cdx/ .cer/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .key/ .printer/ .rdb/ .swp/ .sys/'" setvar:'tx.restricted_extensions=.backup/ .bak/ .cdx/ .cer/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .key/ .printer/ .rdb/ .swp/ .sys/'"
# Modify CRS rule 901165. git-upload-pack has it's own content-type and uses the content-encoding header # Modify CRS rule 901165. git-upload-pack has it's own content-type and uses the content-encoding header
@ -54,7 +54,7 @@ SecRule REQUEST_URI "@endsWith git-upload-pack" \
phase:1,\ phase:1,\
pass,\ pass,\
t:none,\ t:none,\
ver:'gitea-proxy-rule-exclusions-plugin/1.1.0',\ ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
nolog,\ nolog,\
setvar:'tx.allowed_request_content_type=%{TX.allowed_request_content_type} |application/x-git-upload-pack-request|',\ setvar:'tx.allowed_request_content_type=%{TX.allowed_request_content_type} |application/x-git-upload-pack-request|',\
setvar:'tx.restricted_headers_basic=/proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/'" setvar:'tx.restricted_headers_basic=/proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/'"
@ -66,5 +66,15 @@ SecRule REQUEST_FILENAME "@pmFromFile gitea-proxy-whitelisted-files.data" \
pass,\ pass,\
nolog,\ nolog,\
t:none,\ t:none,\
ver:'gitea-proxy-rule-exclusions-plugin/1.1.0',\ ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
ctl:ruleRemoveById=930130" ctl:ruleRemoveById=930130"
# Gitea is written in Go, so disable PHP-related rules, as a PHP git project would cause false positives
SecAction \
"id:92040,\
phase:1,\
pass,\
log,\
t:none,\
ver:'gitea-proxy-rule-exclusions-plugin/1.2.0',\
ctl:ruleRemoveByTag=language-php"