Gitea proxy rule exclusions plugin

2024-07-14 13:22:06 +02:00
parent 5ebd86a12a
commit f5b2d3291e
5 changed files with 127 additions and 2 deletions
@@ -0,0 +1,54 @@
+# ------------------------------------------------------------------------
+# Gitea proxy rule exclusions plugin
+# Copyright (c) 2024 Daniel Demus
+#
+# This plugin is distributed under Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+# Plugin name: gitea-proxy-rule-exclusions
+# Plugin description: OWASP CRS 3rd party plugin for Gitea via proxy
+# Rule ID block base: 92,000 - 92,999
+# Plugin version: 1.0.0
+
+# Documentation can be found here:
+# https://git.demus.dk/demus/gitea-proxy-rule-exclusions-plugin.git
+
+# Generic rule to disable plugin
+SecRule TX:gitea-proxy-rule-exclusions-plugin_enabled "@eq 0" "id:92001,phase:1,pass,nolog,ctl:ruleRemoveById=92002-92999"
+
+#
+# [ Local CRS initialization ]
+#
+# We need to initialize some of the CRS variables also here because plugin setup runs before
+# CRS initialization (this is a known limitation of the current plugin architecture). Must be
+# kept in sync with CRS default setting.
+
+# Copy of CRS rule 901162.
+SecRule &TX:allowed_request_content_type "@eq 0" \
+    "id:92902,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'gitea-proxy-rule-exclusions-plugin/1.0.0',\
+    setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json|'"
+
+# Modify CRS rule 901164
+SecRule &TX:restricted_extensions "@eq 0" \
+    "id:92903,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'gitea-proxy-rule-exclusions-plugin/1.0.0',\
+    setvar:'tx.restricted_extensions=.backup/ .bak/ .cdx/ .cer/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .key/ .printer/ .rdb/ .swp/ .sys/'"
+
+# Modify CRS rule 901165. git-upload-pack has it's own content-type and uses the content-encoding header
+SecRule REQUEST_URI "@endsWith git-upload-pack" \
+    "id:92010,\
+    phase:1,\
+    pass,\
+    t:none,\
+    ver:'gitea-proxy-rule-exclusions-plugin/1.0.0',\
+    nolog,\
+    setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |application/x-git-upload-pack-request|',\
+    setvar:'tx.restricted_headers_basic=/proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/'"
@@ -0,0 +1,43 @@
+# ------------------------------------------------------------------------
+# Gitea proxy rule exclusions plugin
+# Copyright (c) 2024 Daniel Demus
+#
+# This plugin is distributed under Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+# Plugin name: gitea-proxy-rule-exclusions
+# Plugin description: OWASP CRS 3rd party plugin for Gitea via proxy
+# Rule ID block base: 92,000 - 92,999
+# Plugin version: 1.0.0
+
+# Documentation can be found here:
+# https://git.demus.dk/demus/gitea-proxy-rule-exclusions-plugin.git
+
+# Generic rule to disable the plugin
+#
+# Plugins are enabled by default.
+#
+# They become active by placing them in the plugin folder. It is possible to
+# control plugin activation via setting a variable. This can be done in the
+# plugin config file here.
+#
+# The predefined variable name is meant to be "<plugin name>-plugin_enabled".
+# For the gitea-proxy-rule-exclusions-plugin, this means it can be disabled by setting
+# tx.gitea-proxy-rule-exclusions-plugin_enabled=0.
+#
+# Note that a global setting of this variable overrides the setting here.
+# That means the "enabled" variable is only set by this rule if it has not
+# been set before.
+#
+# Feel free to set the variable unconditionally here by replacing the
+# SecRule line with an unconditional SecAction statement.
+#
+# SecRule &TX:gitea-proxy-rule-exclusions-plugin_enabled "@eq 0" \
+#     "id:92000,\
+#     phase:1,\
+#     pass,\
+#     nolog,\
+#     ver:'gitea-proxy-rule-exclusions-plugin/1.0.0',\
+#     setvar:'tx.gitea-proxy-rule-exclusions-plugin_enabled=0'"
+