Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/coreruleset/coreruleset.go

@@ -1,9 +1,9 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, with the five changes sww
-// makes to it, the fixes for the apps SWW_WAF_APPS names, and the exclusions in
-// SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE, as "Attack detection" under "Settings"
-// in SPEC.md describes them. It reads no response.
+// body while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set, with the
+// five changes sww makes to it, the fixes for the apps SWW_WAF_APPS names,
+// and the exclusions in SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE, as "Attack
+// detection" under "Settings" in SPEC.md describes them. It reads no response.
 //
 // sww writes only to its state directory, so Coraza is built with
 // its no_fs_access tag, as the Dockerfile and script/build build it: of a
@@ -34,8 +34,8 @@ import (
 
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
-// SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, the exclusions file for the second,
-// and the directives of every app in apps for the third.
+// SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set, the exclusions file for
+// the second, and the directives of every app in apps for the third.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_CORE_RULE_SET_DISABLED_RULES and the exclusions file refuse, so that no
@@ -43,7 +43,7 @@ import (
 // without the spaces at the start of the next.
 const directives = `
 # The engine only detects. sww compares the request's anomaly
-# score with SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD itself, in block and detect mode
+# score with SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD itself, in block and detect mode
 # alike. It reads no body, unless bodyDirectives switch that on.
 SecRuleEngine DetectionOnly
 SecRequestBodyAccess Off
@@ -224,9 +224,10 @@ type Params struct {
 	// DisabledRules are the ids of the rules switched off
 	// (SWW_WAF_CORE_RULE_SET_DISABLED_RULES).
 	DisabledRules []int
-	// BodyLimit is the most of a request body the Core Rule Set reads
-	// (SWW_WAF_CORE_RULE_SET_BODY_LIMIT), 0 while it is off and it reads none.
-	BodyLimit int64
+	// BodyInspectionSize is the most of a request body the Core Rule Set
+	// reads (SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE), 0 while it is off
+	// and it reads none.
+	BodyInspectionSize int64
 	// ExclusionsFile is the path of a file of exclusions loaded before the
 	// Core Rule Set's rules (SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
 	// there is none.
@@ -351,8 +352,8 @@ type CoreRuleSet struct {
 // it.
 func New(params Params) (*CoreRuleSet, error) {
 	body := ""
-	if params.BodyLimit > 0 {
-		body = fmt.Sprintf(bodyDirectives, params.BodyLimit)
+	if params.BodyInspectionSize > 0 {
+		body = fmt.Sprintf(bodyDirectives, params.BodyInspectionSize)
 	}
 
 	exclusions := ""
@@ -397,7 +398,7 @@ func New(params Params) (*CoreRuleSet, error) {
 
 	return &CoreRuleSet{
 		engine:         engine,
-		bodyLimit:      params.BodyLimit,
+		bodyLimit:      params.BodyInspectionSize,
 		appsByHostname: params.Apps,
 	}, nil
 }
@@ -481,10 +482,11 @@ func (c *CoreRuleSet) Inspect(
 }
 
 // readBody reads body, the body of the request in tx, which has run on
-// the request's headers, while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set and the body is
-// of a kind the Core Rule Set reads: form data and multipart, of which it
-// reads the first c.bodyLimit bytes, and JSON and XML, which it reads only
-// when they are no longer than that, since they cannot be read in part.
+// the request's headers, while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is
+// set and the body is of a kind the Core Rule Set reads: form data and
+// multipart, of which it reads the first c.bodyLimit bytes, and JSON and
+// XML, which it reads only when they are no longer than that, since they
+// cannot be read in part.
 // readBody reads one byte past the limit, to tell which they are, gives
 // the Core Rule Set what it reads, and returns what it read and the error
 // that ended the reading early, if one did.

internal/coreruleset/coreruleset_test.go

@@ -1089,7 +1089,7 @@ var findMisfiringPasswords = sync.OnceValues(func() ([]string, error) {
 	const workers, perBody = 16, 10
 
 	crs, err := loaderFor(coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
 	})()
 	if err != nil {
 		return nil, err
@@ -1166,7 +1166,7 @@ func misfiringPasswords(t *testing.T) []string {
 func wantRandomPasswordsPass(t *testing.T, r request, name string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 	misfiring := misfiringPasswords(t)
@@ -1197,7 +1197,7 @@ func wantRandomPasswordsPass(t *testing.T, r request, name string) {
 func wantPasswordAttacksPass(t *testing.T, r request, names ...string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	for _, attack := range []string{
 		"' OR '1'='1", pathTraversal, "; cat /etc/passwd",
@@ -1217,7 +1217,7 @@ func wantPasswordAttacksPass(t *testing.T, r request, names ...string) {
 func wantPasswordAttacksRefused(t *testing.T, r request, name string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	for _, attack := range []string{scriptTag, "javascript:alert(1)"} {
 		body := passwordBody(t, r, []string{name}, attack)
@@ -1307,7 +1307,7 @@ func TestGiteaPasswordsPass(t *testing.T) {
 func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -1364,7 +1364,7 @@ func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 func TestPasswordExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -1400,7 +1400,7 @@ func TestPasswordExclusionsAreNarrow(t *testing.T) {
 func TestGiteaAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := atDefaults(t)
 
@@ -1480,7 +1480,7 @@ func TestGiteaSearchOnAUsersOrAnOrganisationsPageLetsLsThrough(
 	}
 
 	// A command after a ";" in q is still refused on each of these paths.
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	for _, target := range []string{
 		"/alice?tab=repositories&q=",
@@ -1505,12 +1505,12 @@ const (
 )
 
 // readingBodiesUpTo64K returns the Core Rule Set as sww runs it by default,
-// but reading bodies up to the largest SWW_WAF_CORE_RULE_SET_BODY_LIMIT.
+// but reading bodies up to the largest SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE.
 func readingBodiesUpTo64K(t *testing.T) *coreruleset.CoreRuleSet {
 	t.Helper()
 
 	return shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: 64<<10 - 1,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: 64<<10 - 1,
 	})
 }
 
@@ -1572,7 +1572,7 @@ func wordpressAttackTargets(attack string) []string {
 func TestWordPressAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
 
@@ -2310,7 +2310,8 @@ func TestWordPressExclusionsAreNarrow(t *testing.T) {
 	wantBody(t, crs, signIn, body, matched(930120), body)
 }
 
-// bodyLimit is SWW_WAF_CORE_RULE_SET_BODY_LIMIT in the tests that read bodies.
+// bodyLimit is SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE in the tests that
+// read bodies.
 const bodyLimit = 8 << 10
 
 // The Content-Type headers of the kinds of body the Core Rule Set reads.
@@ -2339,7 +2340,7 @@ func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {
 	t.Helper()
 
 	return shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
 	})
 }
 
@@ -2393,7 +2394,7 @@ func wantBody(
 	}
 }
 
-func TestBodiesAreReadOnlyWhileBodyLimitIsSet(t *testing.T) {
+func TestBodiesAreReadOnlyWhileBodyInspectionSizeIsSet(t *testing.T) {
 	t.Parallel()
 
 	off, on := atDefaults(t), readingBodies(t)
@@ -2748,7 +2749,7 @@ func giteaBranchNamesInBodies() []nameInBody {
 func TestGiteaNamesInBodiesStillRefuseAttacks(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -2929,7 +2930,7 @@ func TestCorazaWritesNoFile(t *testing.T) {
 	// The test loads its own Core Rule Set, since loading is part of what
 	// it checks.
 	crs, err := coreruleset.New(coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
 	})
 	if err != nil {
 		t.Fatalf("load the Core Rule Set: %v", err)
@@ -2945,7 +2946,7 @@ func TestBodyLimitOf1GLoads(t *testing.T) {
 	t.Parallel()
 
 	_, err := coreruleset.New(
-		coreruleset.Params{ParanoiaLevel: 1, BodyLimit: 1 << 30},
+		coreruleset.Params{ParanoiaLevel: 1, BodyInspectionSize: 1 << 30},
 	)
 	if err != nil {
 		t.Errorf("load the Core Rule Set reading bodies up to 1G: %v", err)

internal/coreruleset/drupal.conf

@@ -4,7 +4,7 @@
 # request, before the rules it switches off, so this file is loaded before the
 # Core Rule Set's rules. Each comment names a request a rule refused. An
 # exclusion on a field of a body applies only when the query has no parameter
-# of that name, so it matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is
+# of that name, so it matters only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is
 # set. The exclusions above the comment "The fields below are in bodies" also
 # cover a body field of the same name whatever the query holds, and only those
 # below it need a query without that name.

internal/coreruleset/drupal_test.go

@@ -9,7 +9,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// drupalThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// drupalThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const drupalThreshold = 5
 
 // drupalAddArticle is Drupal's form for a new article.

internal/coreruleset/forgejo.conf

@@ -132,7 +132,7 @@ SecRule REQUEST_FILENAME "@streq /admin/repos" \
 # They skip these rules:
 #   932120: fix-powershell-module
 #   932260: feat/docker-support
-# They are read only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, and skip
+# They are read only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set, and skip
 # nothing when the query has a parameter of the same name.
 SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/rename_branch$" \
     "id:900666,phase:1,pass,nolog,chain"

internal/coreruleset/forgejo_test.go

@@ -91,7 +91,7 @@ var forgejoAttacks = []string{
 func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodies(t)
 
@@ -113,7 +113,7 @@ func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
 func TestForgejoExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := atDefaults(t)
 

internal/coreruleset/ghost.conf

@@ -3,7 +3,7 @@
 # rules it switches off, so this file is loaded before the Core Rule Set's
 # rules. Each comment names a request a rule refused. An exclusion on a field of
 # a body applies only when the query has no parameter of that name, so it
-# matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# matters only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set.
 #
 # Ghost's admin and its integrations call the Admin API under /ghost/api/admin/,
 # themes and Ghost's own scripts call the Content API under /ghost/api/content/,

internal/coreruleset/ghost_test.go

@@ -11,7 +11,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// ghostThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// ghostThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const ghostThreshold = 5
 
 // Paths of Ghost's Admin API, Content API and members' API.

internal/coreruleset/gitea.conf

@@ -394,7 +394,7 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/lastcommit/" \
     "id:900633,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:refSubUrl"
 
 # The requests below name a file or a branch in a body field, which is read only
-# while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set. Each field skips the rules that
+# while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set. Each field skips the rules that
 # refused it.
 # Each field below that names a branch skips these rules:
 #   932120: fix-powershell-module

internal/coreruleset/gitea_test.go

@@ -85,7 +85,7 @@ func TestGiteaAdminFormsLetHardValuesThroughInTheBody(t *testing.T) {
 func TestGiteaFormsThatAdoptARepositoryLetItsNameThrough(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -146,7 +146,7 @@ func TestGiteaFormsThatAdoptARepositoryLetItsNameThrough(t *testing.T) {
 func TestGiteaAttacksAreRefusedInItsSearches(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodies(t)
 
@@ -170,7 +170,7 @@ func TestGiteaAttacksAreRefusedInItsSearches(t *testing.T) {
 func TestGiteaSearchExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := atDefaults(t)
 

internal/coreruleset/mastodon.conf

@@ -5,7 +5,7 @@
 # file is loaded before the Core Rule Set's rules. Each comment names a request
 # a rule refused. An exclusion on a field of a body applies only when the query
 # has no parameter of that name, so it matters only while
-# SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set.
 #
 # Gitea serves /api/v1/ too, and Drupal serves /admin/. So only Mastodon's own
 # resources under them count as Mastodon's paths.

internal/coreruleset/mastodon_test.go

@@ -12,7 +12,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// mastodonThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// mastodonThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const mastodonThreshold = 5
 
 // mastodonStatuses is where Mastodon's apps and web app post.

internal/coreruleset/mediawiki.conf

@@ -5,7 +5,7 @@
 # request, before the rules it switches off, so this file is loaded before the
 # Core Rule Set's rules. Each comment names a request a rule refused. An
 # exclusion on a field of a body applies only when the query has no parameter of
-# that name, so it matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# that name, so it matters only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set.
 # MediaWiki's paths are matched at the site root and under /w/.
 #
 # WordPress serves /index.php too. So /index.php counts as MediaWiki's only

internal/coreruleset/mediawiki_test.go

@@ -9,7 +9,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// mediawikiThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// mediawikiThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const mediawikiThreshold = 5
 
 // mediawiki is MediaWiki's name in SWW_WAF_APPS.
@@ -76,7 +76,7 @@ func TestMediaWikiWatchlistFixAppliesOnlyToAHostnameThatServesMediaWiki(
 	t.Parallel()
 
 	crs := shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
 		Apps: map[string][]string{
 			giteaHost: {gitea},
 			otherHost: {mediawiki},
@@ -120,7 +120,7 @@ func TestMediaWikiPasswordFixesApplyOnlyToAHostnameThatServesMediaWiki(
 	t.Parallel()
 
 	crs := shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
 		Apps: map[string][]string{
 			giteaHost: {gitea},
 			otherHost: {mediawiki},

internal/coreruleset/nextcloud.conf

@@ -5,7 +5,7 @@
 # switches off, so this file is loaded before the Core Rule Set's rules. Each
 # comment names a request a rule refused. An exclusion on a field of a JSON body
 # applies only when the query has no parameter of that name, so it matters only
-# while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set. Nextcloud's pages are matched
+# while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set. Nextcloud's pages are matched
 # at the site root and under /index.php/, where a Nextcloud without pretty URLs
 # serves them.
 #

internal/coreruleset/nextcloud_test.go

@@ -13,7 +13,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// nextcloudThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// nextcloudThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const nextcloudThreshold = 5
 
 // nextcloudSignIn is the sign-in page.
@@ -102,7 +102,7 @@ func TestNextcloudPasswordInValuePassesOnlyOnHostnamesThatServeNextcloud(
 	t.Parallel()
 
 	crs := shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: bodyLimit,
 		Apps: map[string][]string{
 			giteaHost: {gitea},
 			otherHost: {nextcloud},
@@ -528,7 +528,7 @@ func TestNextcloudPasswordFieldsPass(t *testing.T) {
 func TestNextcloudUserPasswordInValuePasses(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 	target := nextcloudUsers + "/alice"

internal/coreruleset/recorded_test.go

@@ -57,7 +57,7 @@ func giteaRequests(t *testing.T) []request {
 func TestOrdinaryGiteaRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	requests := giteaRequests(t)
 	giteaOnly := map[string][]string{giteaHost: {gitea}}
@@ -133,7 +133,7 @@ func recordedRequests(t *testing.T, name string) []recordedRequest {
 func wantRecordedRequestsPass(t *testing.T, name, app string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	requests := recordedRequests(t, name)
 
@@ -144,7 +144,7 @@ func wantRecordedRequestsPass(t *testing.T, name, app string) {
 		defaults := servingApps(t, apps)
 		bodies := shared(t, coreruleset.Params{
 			ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
-			BodyLimit: bodyLimit, Apps: apps,
+			BodyInspectionSize: bodyLimit, Apps: apps,
 		})
 
 		for _, recorded := range requests {
@@ -214,7 +214,7 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	requests := recordedRequests(t, "forgejo-requests.txt")
 	forgejoOnly := map[string][]string{"example.com": {forgejo}}

internal/coreruleset/vaultwarden.conf

@@ -5,7 +5,7 @@
 # before the rules it switches off, so this file is loaded before the Core Rule
 # Set's rules. Each comment names a request a rule refused. An exclusion on a
 # field of a body applies only when the query has no parameter of that name, so
-# it matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# it matters only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set.
 #
 # The apps encrypt the names, notes, addresses and file names of vault items,
 # folders, collections and sends before they send them. These values pass

internal/coreruleset/vaultwarden_test.go

@@ -13,7 +13,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// vaultwardenThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// vaultwardenThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const vaultwardenThreshold = 5
 
 // Paths of Vaultwarden's API and admin page.

internal/coreruleset/wordpress.conf

@@ -3,7 +3,7 @@
 # the rules it switches off, so this file is loaded before the Core Rule Set's
 # rules. Each comment names a request the rule refused. An exclusion on a field
 # of a body applies only when the query has no parameter of that name, so it
-# matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# matters only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set.
 
 # Every rule below is skipped unless Inspect has set tx.app_wordpress. It sets
 # it while SWW_WAF_APPS is unset, or lists wordpress for the request's hostname.