403 access forbidden by rule when .git in url path

[NathanBeirens]

I have migrated from npm a bit ago but have noticed that on my gitea instance I can't open certain urls anymore.

The url I try to open is
https://gitea.<domain>/<username>/<project_name>/src/branch/main/.gitea/workflows
which results in a 403 from npm plus with this log line console

[error] 70889#70889: *369636 access forbidden by rule, client: <pc_ip>, server: gitea.*, request: "GET /<username>/<project_name>/src/branch/main/.gitea/workflows HTTP/2.0", host: "gitea.<domain>"

url that gives the same 403
https://gitea.<domain>/<username>/<project_name>/src/branch/main/.git
https://gitea.<domain>/<username>/<project_name>/src/branch/main/.git/workflows

urls that for example don't get blocked by npmplus
https://gitea.<domain>/<username>/<project_name>/src/branch/main/gitea/workflows notice only the . was removed
https://gitea.<domain>/<username>/<project_name>/src/branch/main/git
https://gitea.<domain>/<username>/<project_name>/src/branch/main/git/workflows
https://gitea.<domain>/<username>/<project_name>/src/branch/main/.testurl/workflows
https://gitea.<domain>/<username>/<project_name>/src/branch/main?hello=.git

I have no config in my advanced tab for this proxy host.
ModSecurity & coreRuleSet are Disabled.

I assume there are some extra default settings that are being shiped with npmplus that where not present in npm.
Any suggestions where these rules can be found / configured?

[Zoey2936]

yes, all requests containing "/.git will be blocked, I will can either remove this rule or change it to "/.git/" so that /.gitea would be allowed

[NathanBeirens]

which way to allow it is up to your discretion as I don't have much exp in this field.
my guess would be to adapt the rule to be /.git/ but again I don't have much exp with this.

some background: the .gitea folder (more specific .gitea/workflows/ path) is where gitea users are required to place their workflow files.
source:
https://docs.gitea.com/usage/actions/quickstart

thanks for the blazingly fast reply already though.

[Zoey2936]

/.git mean that /.git/abc /.gitttttttttttttttttttttttttttttttt ./gitea/abc will be blocked
/.git/ means /.git/abc will be blocked

[NathanBeirens]

then /.git/ should be the rule
as that should from my understanding would allow
/.gitea/
/.gitea/workflows
/.gitea/workflows/my_workflow.yaml
/.gitea/*

[NathanBeirens]

I can confirm that this is fixed with commit
43ca05a

thanks Zoey for the fast responses & fix