Core Rule Set: WordPress's names and addresses pass on more fields (closes #245)
check / check (push) Failing after 2m54s

The four rules on system files and commands (930120, 932120, 932250,
932260) now skip:

- page, p, postId and slug on all of wp-admin;
- url on the block editor's link previews and embeds, by widening the
  REST group to /wp-block-editor/v1/ and /oembed/1.0/;
- the JSON fields title, excerpt, slug and name on /wp/v2/ routes.

A commenter's url skips 930120 and 932120 only. Every field keeps 932235.
Add 61 requests recorded from WordPress 7.1.4 with these fields.

Model: opus-5-5
This commit is contained in:
clawbot committed 2026-11-09 19:27:26 +00:00
1 parent decd9b4658
commit 1e39603125
5 files changed
+238 -17

No files matched your search

+3 -3
View File
@@ -586,9 +586,9 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
HTTP and sign-in through Git Credential Manager on a code forge, and saving a
post from the block editor on WordPress. On gitea's own paths, its searches,
file names and branch names get through too. On WordPress's own paths, its
searches and file names do. On Drupal's own paths, the page to return to, its
searches and its names get through too. No setting undoes the changes; "Attack
detection" in [`SPEC.md`](SPEC.md) lists them.
searches, names and file names do. On Drupal's own paths, the page to return
to, its searches and its names get through too. No setting undoes the changes;
"Attack detection" in [`SPEC.md`](SPEC.md) lists them.
- These apps work out of the box at the default settings, and their recorded
ordinary requests pass the Core Rule Set:
- gitea;