From 2bfdea3f6671ce3bd71155f2b1ada92b2288c340 Mon Sep 17 00:00:00 2001 From: sneak Date: Tue, 10 Nov 2026 10:59:31 +0000 Subject: [PATCH] Core Rule Set tests: WordPress's recorded requests go through the shared check (closes #284) WordPress's recorded requests now go through wantRecordedRequestsPass, so a request with no body but a Content-Type is also inspected while bodies are read, as every other app's is. The seven such requests, wp-cron.php's, pass; wordpress.conf is unchanged. Model: opus-5-5 --- internal/coreruleset/coreruleset_test.go | 22 ++-------------------- 1 file changed, 2 insertions(+), 20 deletions(-) diff --git a/internal/coreruleset/coreruleset_test.go b/internal/coreruleset/coreruleset_test.go index 6422e12..f4d6318 100644 --- a/internal/coreruleset/coreruleset_test.go +++ b/internal/coreruleset/coreruleset_test.go @@ -841,28 +841,10 @@ func TestOrdinaryWordPressRequestsPassAndAttacksAreRefused(t *testing.T) { const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default + wantRecordedRequestsPass(t, "wordpress-requests.txt") + defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t) - for _, recorded := range recordedRequests(t, "wordpress-requests.txt") { - t.Run(recorded.Method+" "+recorded.Target, func(t *testing.T) { - t.Parallel() - - r := request{recorded.Method, recorded.Target, recorded.Headers} - - crsSets := []*coreruleset.CoreRuleSet{defaults} - if recorded.Body != "" { - crsSets = append(crsSets, bodies) - } - - for _, crs := range crsSets { - got, _ := inspectBody(t, crs, r, recorded.Body) - if got.Score >= threshold { - t.Errorf("%s %s %.200q refused: %+v", r.method, r.target, recorded.Body, got) - } - } - }) - } - for _, attack := range []string{ sqlInjection, "..%2F..%2Fwp-config.php",