Core Rule Set: WordPress's names and addresses pass on more fields (closes #245)
check / check (push) Successful in 4m35s

The four rules on system files and commands (930120, 932120, 932250,
932260) now skip:

- page, p, postId and slug on all of wp-admin;
- url on the block editor's link previews and embeds: the REST group
  now covers /wp-block-editor/v1/ and /oembed/1.0/;
- the JSON fields title, excerpt, slug and name on /wp/v2/ routes.

A commenter's url skips 930120 and 932120 only. Every field keeps 932235.
Add 61 requests recorded from WordPress 7.1.4 with these fields.

Model: opus-5-5
This commit is contained in:
clawbot committed 2026-11-09 19:35:08 +00:00
1 parent decd9b4658
commit 45deab094f
5 files changed
+272 -37

No files matched your search

+12 -2
View File
@@ -869,10 +869,14 @@ changes hold in front of every app, and no setting undoes them:
- the searches `s`, `search`, `q` and `term`;
- the names `tag`, `category_name`, `plugin`, `checked[]`, `theme`
and `stylesheet`;
- the name of a plugin's settings page in `page`;
- the name of a template in `p` and `postId` of the site editor;
- the name of a plugin to install in `slug`;
- the addresses `url`, `return`, `redirect_to`, `wp_http_referer`
and `_wp_http_referer`.
- On every REST API route under `/wp/v2/` and on the route
`/oembed/1.0/embed`: `search`, `term`, `slug` and `url`.
- On every REST API route under `/wp/v2/`, `/wp-block-editor/v1/` and
`/oembed/1.0/`: `search`, `term`, `slug` and `url`. The block editor's
link previews and embeds send an address in `url`.
- On `/`, `/index.php`, `/page/N/` and `/index.php/page/N/`: `s` and
`tag`.
@@ -893,6 +897,12 @@ changes hold in front of every app, and no setting undoes them:
- `newcontent` of a plugin's or a theme's file saved from its editor,
which is PHP.
- `pwd` when signing in, for the list of system files (930120).
- `title`, `excerpt`, `slug` and `name` of a post or a tag saved through
a REST API route under `/wp/v2/`, for the rules on system files and
commands (930120, 932120, 932250, 932260).
- `url` on `/wp-comments-post.php`, the address of a commenter's site,
for the lists of system files and PowerShell commands (930120,
932120).
Elsewhere this change does not apply. The paths are those of WordPress at
the site root. An app other than WordPress that serves one of them must