Core Rule Set: a repository's name passes in the adopt form's id (closes #365)
check / check (push) Waiting to run

While bodies are read, the admin forms that adopt or delete an unadopted
repository were refused when the repository's name held a command or a
system file's name, such as alice/python3-app, alice/powershell-scripts or
alice/.profile. id there now skips 930120, 932120 and 932260, on gitea's
/-/admin/repos/unadopted and Forgejo's /admin/repos/unadopted.

Model: opus-5-5
This commit is contained in:
clawbot committed 2026-11-12 00:57:39 +00:00
1 parent 0b23352767
commit 3044b823f3
3 files changed
+70 -6

No files matched your search

+8 -3
View File
@@ -812,9 +812,9 @@ The changes hold in front of every app, and no setting undoes them:
a push reuses a layer, `from` names the image the layer comes from. An image
such as `owner/python3-app` would have that push refused.
8. On gitea's paths, some fields skip the rules that refused ordinary gitea
requests there. They are the fields where gitea sends a search, a file name
or a branch name. `internal/coreruleset/gitea.conf` lists each rule and the
request it refused. The fields are:
requests there. They are the fields where gitea sends a search, a file name,
a branch name or a repository's name. `internal/coreruleset/gitea.conf` lists
each rule and the request it refused. The fields are:
- `q` on gitea's searches of code, of issues and pull requests, and of
commits. A code search holds code, such as `<script>`,
`SELECT * FROM users WHERE` or `../`.
@@ -884,6 +884,11 @@ The changes hold in front of every app, and no setting undoes them:
- to start a release from a tag;
- to edit a branch protection rule;
- to list a directory's last commits.
- `id` of the admin forms that adopt or delete an unadopted repository, for
the lists of system files and command names (930120, 932120, 932260). `id`
holds the repository's owner and name, such as `alice/python3-app` or
`alice/.profile`. gitea serves the forms at `/-/admin/repos/unadopted` and
Forgejo at `/admin/repos/unadopted`.
- The `Content-Range` header of an artifact upload from
`actions/upload-artifact@v3` (920450).
- The passwords in a body, for each rule that random passwords set off. The