Recorded from gitea 1.27.3 and Forgejo 17.0.1 with each registry's own
client, and curl for the Chef cookbook list and NuGet's Packages(), with
python3, powershell, ls -la, .htaccess, file names and plain words. q on
the Cargo, Chef, Composer and Conan searches and NuGet's search service
joins 900603. 900605 lets /bin/sh through on Composer and Conan. New:
900609 for npm's text, 900611 lets a Conan pattern such as zlib/* skip
942100, and 900612 for NuGet's Search() and Packages(): searchTerm,
$filter, and the names $filter, $orderby and $top for 942290.
Model: opus-5-5
Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on the API's searches of
topics, of an organisation's teams and of emails joins 900603, which skips
930120, 932120, 932250 and 932260. The same four rules are skipped by
query on the search of unadopted repositories (900607) and by name on the
search of a repository's milestones (900608). 900605 also lets /bin/sh
through in q on the API's search of packages, since a package name can
hold a slash. The searches of repositories, users and issues already
passed.
Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>
Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.
Model: opus-5-5
Every setting of waf and rproxy is read through viper, in place of the
os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and
AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.
The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take
SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's
settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.
Model: deepseek-v4-pro (first version); opus-5-5 (rework)
While bodies are read, the forms that adopt or delete an unadopted
repository were refused when the repository's name held a command, a
system file's name or a shell path, such as alice/python3-app,
alice/.profile or robin/assets. id there now skips 930120, 932120, 932160
and 932260. The paths are gitea's /-/admin/repos/unadopted, Forgejo's
/admin/repos/unadopted, and /user/settings/repos/unadopted, which both
serve.
Model: opus-5-5
Recorded with python3, powershell, ls -la, .htaccess, file names and plain
words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips
930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and
Forgejo's /admin/ alike, and in the body of the admin forms that adopt a
repository or activate an email. The issue and pull request searches of a
team and of a milestone join 900600 and 900601, as a repository's do. A
repository's packages page and the admin packages page join 900602, which
also skips 944130. 900605, which lets /bin/sh through in q on branches and
owner packages, now also covers the tags page and those two pages, since tag
and package names can hold a slash.
Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>
clawbot