sneak/smallwebwaf
1
0
Fork 0
Code Issues 43 Pull Requests 2 Actions 39 Packages Projects Releases Wiki Activity

SPEC: further gitea refusals collected in a follow-up issue (closes #6)

Browse Source 
Risks now says that gitea requests the Core Rule Set may still refuse at the defaults, found by reading gitea's source, are gathered in #30 and checked against a running gitea in milestone 1, rather than added to the spec one by one.

Model: opus-5-5
This commit is contained in:
sneak
2026-09-28 22:43:07 +00:00
parent 7b48306203
commit 621c78df42
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SPEC.md
+4 -1
View File
@@ -1303,7 +1303,10 @@ networks:
- Core Rule Set false positives against real apps (a search for code, and any - Core Rule Set false positives against real apps (a search for code, and any
body once `WAF_BODY_LIMIT` is set): a match refuses only that request and bans body once `WAF_BODY_LIMIT` is set): a match refuses only that request and bans
no one by itself; the request log names the rule, and exclusions by rule id no one by itself; the request log names the rule, and exclusions by rule id
and path fix it. and path fix it. Further gitea requests the Core Rule Set may refuse at the
defaults, found by reading gitea's source rather than a running gitea, are
collected in https://git.eeqj.de/sneak/smallwebwaf/issues/30 and checked when
milestone 1 runs in front of a real gitea.
- Attacks carried in request bodies: not refused by default, since on a code - Attacks carried in request bodies: not refused by default, since on a code
forge bodies are full of code the Core Rule Set takes for attacks. Most of forge bodies are full of code the Core Rule Set takes for attacks. Most of
what shows in URLs and headers is still refused, the client that sends an what shows in URLs and headers is still refused, the client that sends an